Overview

overview

10

Static

static

10

2026-07-15...ar.exe

windows10-2004-x64

9

2026-07-15...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/07/2026, 00:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-15_4a194671a0c90767e5b839a8c83585b3_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
  • Size 18.7MB
  • Sample260716-ac7cssgw7p
  • SHA256 dd6134dd4af1cd4e040a8382f00cadee01fe3368ca3ad5d3b96bbe342f744d8a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Detects executables manipulated with Fody 1 IoCs
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Drops startup file 10 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 14 IoCs
    persistence
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 18 IoCs
  • Launches sc.exe 64 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 55 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-15_4a194671a0c90767e5b839a8c83585b3_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-15_4a194671a0c90767e5b839a8c83585b3_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3552
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABACBCBCACBCBABCBCAABBACCAABCBCABCCACBCABBCBABCAAABACCCACACBCABCBBCAAABABCACCBCACAAABBBCBACACABACBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCBBBAABBCCBCACBACACCAACBAAACABCBBAACCBCABCCBBCACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1752
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABACBCBCACBCBABCBCAABBACCAABCBCABCCACBCABBCBABCAAABACCCACACBCABCBBCAAABABCACCBCACAAABBBCBACACABACBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCBBBAABBCCBCACBACACCAACBAAACABCBBAACCBCABCCBBCACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:4036
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBBBCCCABCCBAACCACABBBCCCCACCBACBBBBABCABACACABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCBBBAABBCCBCACBACACCAACBAAACABCBBAACCBCABCCBBCACAC.exe" start= auto displayName= "UserDataSvc_ACCBBBCCCABCCBAACCACABBBCCCCACCBACBBBBABCABACACABBB"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2692
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_ACCBBBCCCABCCBAACCACABBBCCCCACCBACBBBBABCABACACABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCBBBAABBCCBCACBACACCAACBAAACABCBBAACCBCABCCBBCACAC.exe" start= auto displayName= "UserDataSvc_ACCBBBCCCABCCBAACCACABBBCCCCACCBACBBBBABCABACACABBB"
        3⤵
        • Launches sc.exe
        PID:564
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBBBCCCABCCBAACCACABBBCCCCACCBACBBBBABCABACACABBB"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3288
      • C:\Windows\SysWOW64\sc.exe
        sc start "UserDataSvc_ACCBBBCCCABCCBAACCACABBBCCCCACCBACBBBBABCABACACABBB"
        3⤵
        • Launches sc.exe
        PID:3848
  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCBBBAABBCCBCACBACACCAACBAAACABCBBAACCBCABCCBBCACAC.exe
    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCBBBAABBCCBCACBACACCAACBAAACABCBBAACCBCABCCBBCACAC.exe
    1⤵
    • Drops startup file
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5244
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACAABABCABBACCBACCAABABBCACBABBCCAACBAABBABCBBCABABAABBACBCBBCBBCCAABCACCBABBBACBACABACBCBBACCCBBBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABABCACACCABBCCBAAACBBACABBCCCAABBABBBBCCBACBBBCABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5736
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACAABABCABBACCBACCAABABBCACBABBCCAACBAABBABCBBCABABAABBACBCBBCBBCCAABCACCBABBBACBACABACBCBBACCCBBBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABABCACACCABBCCBAAACBBACABBCCCAABBABBBBCCBACBBBCABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:556
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAABBACABBBBABCCAAACABBCCCBBBACABCBACABBACCAAAACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABABCACACCABBCCBAAACBBACABBCCCAABBABBBBCCBACBBBCABCC.exe" start= auto displayName= "UserDataSvc_BAAABBACABBBBABCCAAACABBCCCBBBACABCBACABBACCAAAACAA"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:64
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_BAAABBACABBBBABCCAAACABBCCCBBBACABCBACABBACCAAAACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABABCACACCABBCCBAAACBBACABBCCCAABBABBBBCCBACBBBCABCC.exe" start= auto displayName= "UserDataSvc_BAAABBACABBBBABCCAAACABBCCCBBBACABCBACABBACCAAAACAA"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:1408
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAABBACABBBBABCCAAACABBCCCBBBACABCBACABBACCAAAACAA"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5136
      • C:\Windows\SysWOW64\sc.exe
        sc start "UserDataSvc_BAAABBACABBBBABCCAAACABBCCCBBBACABCBACABBACCAAAACAA"
        3⤵
        • Launches sc.exe
        PID:116
  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCBBBAABBCCBCACBACACCAACBAAACABCBBAACCBCABCCBBCACAC.exe
    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCBBBAABBCCBCACBACACCAACBAAACABCBBAACCBCABCCBBCACAC.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5092
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCAACCBCCBACBBBCCBCCCABBCCAACABCACBCAAAAABCBBCACACBAAABCBCACBCCBCAABCCBBBABACBBBBBCACABCCBAAABAAAACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBAAAACACBBAABAABABBBACCBCACBBCACBAAABCCABACCAAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5664
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCAACCBCCBACBBBCCBCCCABBCCAACABCACBCAAAAABCBBCACACBAAABCBCACBCCBCAABCCBBBABACBBBBBCACABCCBAAABAAAACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBAAAACACBBAABAABABBBACCBCACBBCACBAAABCCABACCAAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3100
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACCBBACABACABAACBCBBBCBAABACCBBABCBCBCCCAAACBAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBAAAACACBBAABAABABBBACCBCACBBCACBAAABCCABACCAAACAA.exe" start= auto displayName= "UserDataSvc_CAACCBBACABACABAACBCBBBCBAABACCBBABCBCBCCCAAACBAABA"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5776
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_CAACCBBACABACABAACBCBBBCBAABACCBBABCBCBCCCAAACBAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBAAAACACBBAABAABABBBACCBCACBBCACBAAABCCABACCAAACAA.exe" start= auto displayName= "UserDataSvc_CAACCBBACABACABAACBCBBBCBAABACCBBABCBCBCCCAAACBAABA"
        3⤵
          PID:8
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAACCBBACABACABAACBCBBBCBAABACCBBABCBCBCCCAAACBAABA"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:6092
        • C:\Windows\SysWOW64\sc.exe
          sc start "UserDataSvc_CAACCBBACABACABAACBCBBBCBAABACCBBABCBCBCCCAAACBAABA"
          3⤵
          • Launches sc.exe
          PID:4532
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABABCACACCABBCCBAAACBBACABBCCCAABBABBBBCCBACBBBCABCC.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABABCACACCABBCCBAAACBBACABBCCCAABBABBBBCCBACBBBCABCC.exe
      1⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4784
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCACBCACBAACCAACAACABCCBBCBBABAAAABAABBAAABAABBBACAAAABACCCABCCBACBAACBABBBAAAAAACAACACACBBBACCAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBACBABBAACCCAAAACABABBBBCCAACCBCBCABBCABCBCCCCABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2400
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCACBCACBAACCAACAACABCCBBCBBABAAAABAABBAAABAABBBACAAAABACCCABCCBACBAACBABBBAAAAAACAACACACBBBACCAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBACBABBAACCCAAAACABABBBBCCAACCBCBCABBCABCBCCCCABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:3356
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBACCBACBCCCABACCCCABACAACBBAABBABAABABCBCACBCBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBACBABBAACCCAAAACABABBBBCCAACCBCBCABBCABCBCCCCABBAB.exe" start= auto displayName= "UserDataSvc_CBBACCBACBCCCABACCCCABACAACBBAABBABAABABCBCACBCBCCB"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2108
        • C:\Windows\SysWOW64\sc.exe
          sc create "UserDataSvc_CBBACCBACBCCCABACCCCABACAACBBAABBABAABABCBCACBCBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBACBABBAACCCAAAACABABBBBCCAACCBCBCABBCABCBCCCCABBAB.exe" start= auto displayName= "UserDataSvc_CBBACCBACBCCCABACCCCABACAACBBAABBABAABABCBCACBCBCCB"
          3⤵
            PID:3244
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBACCBACBCCCABACCCCABACAACBBAABBABAABABCBCACBCBCCB"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1196
          • C:\Windows\SysWOW64\sc.exe
            sc start "UserDataSvc_CBBACCBACBCCCABACCCCABACAACBBAABBABAABABCBCACBCBCCB"
            3⤵
              PID:4244
        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABABCACACCABBCCBAAACBBACABBCCCAABBABBBBCCBACBBBCABCC.exe
          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABABCACACCABBCCBAAACBBACABBCCCAABBABBBBCCBACBBBCABCC.exe
          1⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2356
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAACBBACCCCBABABCCBBACABBBBCBBAABACAAABAACBCCAACBCBABBABBACBBBBACBCBAAABABACBAACBABBBCCCCCBBCCACBACBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAABCABABBACAACABABBACBBCBBCAABBBACABAACABCABCCCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:5052
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAACBBACCCCBABABCCBBACABBBBCBBAABACAAABAACBCCAACBCBABBABBACBBBBACBCBAAABABACBAACBABBBCCCCCBBCCACBACBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAABCABABBACAACABABBACBBCBBCAABBBACABAACABCABCCCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:6052
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBCBBBCBABACBBBACACCABACCACAACCACCCBAAAABBCCCCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAABCABABBACAACABABBACBBCBBCAABBBACABAACABCABCCCBBA.exe" start= auto displayName= "UserDataSvc_ABBBCBBBCBABACBBBACACCABACCACAACCACCCBAAAABBCCCCAAB"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:656
            • C:\Windows\SysWOW64\sc.exe
              sc create "UserDataSvc_ABBBCBBBCBABACBBBACACCABACCACAACCACCCBAAAABBCCCCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAABCABABBACAACABABBACBBCBBCAABBBACABAACABCABCCCBBA.exe" start= auto displayName= "UserDataSvc_ABBBCBBBCBABACBBBACACCABACCACAACCACCCBAAAABBCCCCAAB"
              3⤵
              • Launches sc.exe
              PID:3488
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBCBBBCBABACBBBACACCABACCACAACCACCCBAAAABBCCCCAAB"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1108
            • C:\Windows\SysWOW64\sc.exe
              sc start "UserDataSvc_ABBBCBBBCBABACBBBACACCABACCACAACCACCCBAAAABBCCCCAAB"
              3⤵
              • Launches sc.exe
              PID:2644
        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBACBABBAACCCAAAACABABBBBCCAACCBCBCABBCABCBCCCCABBAB.exe
          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBACBABBAACCCAAAACABABBBBCCAACCBCBCABBCABCBCCCCABBAB.exe
          1⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2588
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAABABACAABCBCBACBACBCBBCBBBABCCCABCBCBBCABCACCBCBABBAABABBAABABCCCABACBBACBBBCBBBBCACCAAAAACBCBCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABABACAABCBCBACBACBCBBCBBBABCCCABCBCBBCABCACCBCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2272
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAABABACAABCBCBACBACBCBBCBBBABCCCABCBCBBCABCACCBCBABBAABABBAABABCCCABACBBACBBBCBBBBCACCAAAAACBCBCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABABACAABCBCBACBACBCBBCBBBABCCCABCBCBBCABCACCBCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:4808
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCAABBCBBCAACCABCCAABCBCBCCCCCBCACCBBBABBAABACBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABABACAABCBCBACBACBCBBCBBBABCCCABCBCBBCABCACCBCBABB.exe" start= auto displayName= "UserDataSvc_BABCAABBCBBCAACCABCCAABCBCBCCCCCBCACCBBBABBAABACBBA"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2100
            • C:\Windows\SysWOW64\sc.exe
              sc create "UserDataSvc_BABCAABBCBBCAACCABCCAABCBCBCCCCCBCACCBBBABBAABACBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABABACAABCBCBACBACBCBBCBBBABCCCABCBCBBCABCACCBCBABB.exe" start= auto displayName= "UserDataSvc_BABCAABBCBBCAACCABCCAABCBCBCCCCCBCACCBBBABBAABACBBA"
              3⤵
              • Launches sc.exe
              PID:2076
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABCAABBCBBCAACCABCCAABCBCBCCCCCBCACCBBBABBAABACBBA"
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5600
            • C:\Windows\SysWOW64\sc.exe
              sc start "UserDataSvc_BABCAABBCBBCAACCABCCAABCBCBCCCCCBCACCBBBABBAABACBBA"
              3⤵
                PID:2460
          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBACBABBAACCCAAAACABABBBBCCAACCBCBCABBCABCBCCCCABBAB.exe
            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBACBABBAACCCAAAACABABBBBCCAACCBCBCABBCABCBCCCCABBAB.exe
            1⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4364
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBBABBACBBBBCBCCACAACBCACAAAAAACABBCCBCCBABACBABAABAACACAABBBBABBBBCBAAABBBBBBABAABBCABACBCACCCCBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCCACCCBCCCBCCBBBBCACCACCBCBCCABAACCCBAACBBCCCCBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3572
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBBABBACBBBBCBCCACAACBCACAAAAAACABBCCBCCBABACBABAABAACACAABBBBABBBBCBAAABBBBBBABAABBCABACBCACCCCBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCCACCCBCCCBCCBBBBCACCACCBCBCCABAACCCBAACBBCCCCBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:472
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCACCCBABCCCBBCACBAABBACBCCBAAACBCCABBBBBBBACACBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCCACCCBCCCBCCBBBBCACCACCBCBCCABAACCCBAACBBCCCCBCBC.exe" start= auto displayName= "UserDataSvc_ACCACCCBABCCCBBCACBAABBACBCCBAAACBCCABBBBBBBACACBAC"
              2⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3108
              • C:\Windows\SysWOW64\sc.exe
                sc create "UserDataSvc_ACCACCCBABCCCBBCACBAABBACBCCBAAACBCCABBBBBBBACACBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCCACCCBCCCBCCBBBBCACCACCBCBCCABAACCCBAACBBCCCCBCBC.exe" start= auto displayName= "UserDataSvc_ACCACCCBABCCCBBCACBAABBACBCCBAAACBCCABBBBBBBACACBAC"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:460
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCACCCBABCCCBBCACBAABBACBCCBAAACBCCABBBBBBBACACBAC"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:5384
              • C:\Windows\SysWOW64\sc.exe
                sc start "UserDataSvc_ACCACCCBABCCCBBCACBAABBACBCCBAAACBCCABBBBBBBACACBAC"
                3⤵
                • Launches sc.exe
                PID:2164
          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBAAAACACBBAABAABABBBACCBCACBBCACBAAABCCABACCAAACAA.exe
            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBAAAACACBBAABAABABBBACCBCACBBCACBAAABCCABACCAAACAA.exe
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5896
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBBCCBCCABCBCACBABBCBBACABBBCCAAABBCAABCCBCACBACBCCCAACBCACAABBCAACBABABAACABCCCBCCCACCAAABCCCBBBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCCAACCAACBABBBCCABABCABCCCCACABBCBACCBBCACCACBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3608
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBBCCBCCABCBCACBABBCBBACABBBCCAAABBCAABCCBCACBACBCCCAACBCACAABBCAACBABABAACABCCCBCCCACCAAABCCCBBBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCCAACCAACBABBBCCABABCABCCCCACABBCBACCBBCACCACBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:4228
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBBABBACABBAAACCCCAACBBBAACABBAAABABACCCCCABABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCCAACCAACBABBBCCABABCABCCCCACABBCBACCBBCACCACBCBB.exe" start= auto displayName= "UserDataSvc_CABBBABBACABBAAACCCCAACBBBAACABBAAABABACCCCCABABBAC"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:380
              • C:\Windows\SysWOW64\sc.exe
                sc create "UserDataSvc_CABBBABBACABBAAACCCCAACBBBAACABBAAABABACCCCCABABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCCAACCAACBABBBCCABABCABCCCCACABBCBACCBBCACCACBCBB.exe" start= auto displayName= "UserDataSvc_CABBBABBACABBAAACCCCAACBBBAACABBAAABABACCCCCABABBAC"
                3⤵
                  PID:1512
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBBABBACABBAAACCCCAACBBBAACABBAAABABACCCCCABABBAC"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:5672
                • C:\Windows\SysWOW64\sc.exe
                  sc start "UserDataSvc_CABBBABBACABBAAACCCCAACBBBAACABBAAABABACCCCCABABBAC"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2156
            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAABCABABBACAACABABBACBBCBBCAABBBACABAACABCABCCCBBA.exe
              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAABCABABBACAACABABBACBBCBBCAABBBACABAACABCABCCCBBA.exe
              1⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3776
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBBAACBCCCCCBCCAAABACCBCAAABBBACBAAAACACBACCAABCBAACCABACBAABBCBCCCACBAABBCACABBCACBBBBCCBABACAAACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAACAABCBCABCBBBBCCACBACCACCABBAAABBAACBBCABBBCBCCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3028
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBBAACBCCCCCBCCAAABACCBCAAABBBACBAAAACACBACCAABCBAACCABACBAABBCBCCCACBAABBCACABBCACBBBBCCBABACAAACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAACAABCBCABCBBBBCCACBACCACCABBAAABBAACBBCABBBCBCCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                  3⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:3656
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACABBBCABAABBBBACCBBBACCAAACBACABCCCBCACCBABBCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAACAABCBCABCBBBBCCACBACCACCABBAAABBAACBBCABBBCBCCBBB.exe" start= auto displayName= "UserDataSvc_BBACABBBCABAABBBBACCBBBACCAAACBACABCCCBCACCBABBCCBC"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:5948
                • C:\Windows\SysWOW64\sc.exe
                  sc create "UserDataSvc_BBACABBBCABAABBBBACCBBBACCAAACBACABCCCBCACCBABBCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAACAABCBCABCBBBBCCACBACCACCABBAAABBAACBBCABBBCBCCBBB.exe" start= auto displayName= "UserDataSvc_BBACABBBCABAABBBBACCBBBACCAAACBACABCCCBCACCBABBCCBC"
                  3⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:3760
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACABBBCABAABBBBACCBBBACCAAACBACABCCCBCACCBABBCCBC"
                2⤵
                  PID:5272
                  • C:\Windows\SysWOW64\sc.exe
                    sc start "UserDataSvc_BBACABBBCABAABBBBACCBBBACCAAACBACABCCCBCACCBABBCCBC"
                    3⤵
                    • Launches sc.exe
                    PID:3592
              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABABACAABCBCBACBACBCBBCBBBABCCCABCBCBBCABCACCBCBABB.exe
                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABABACAABCBCBACBACBCBBCBBBABCCCABCBCBBCABCACCBCBABB.exe
                1⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:5544
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABCACCBCACBCACBBBAABCCACABACCBACBBBBACACBACCAACAAACABCACCAACACBACBCACAAACABABCBABBCAACCBABBABBBBBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACABBBAACCCBBBAAABCCABACACBCAAACBCBCCACBAABAABCAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:6008
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABCACCBCACBCACBBBAABCCACABACCBACBBBBACACBACCAACAAACABCACCAACACBACBCACAAACABABCBABBCAACCBABBABBBBBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACABBBAACCCBBBAAABCCABACACBCAAACBCBCCACBAABAABCAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                    3⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:3968
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCCABBAAACABCBBBAAACABBBBCBBCACCACCCCCBCABBBCABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACABBBAACCCBBBAAABCCABACACBCAAACBCBCCACBAABAABCAAAAC.exe" start= auto displayName= "UserDataSvc_CBCCCABBAAACABCBBBAAACABBBBCBBCACCACCCCCBCABBBCABCA"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4320
                  • C:\Windows\SysWOW64\sc.exe
                    sc create "UserDataSvc_CBCCCABBAAACABCBBBAAACABBBBCBBCACCACCCCCBCABBBCABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACABBBAACCCBBBAAABCCABACACBCAAACBCBCCACBAABAABCAAAAC.exe" start= auto displayName= "UserDataSvc_CBCCCABBAAACABCBBBAAACABBBBCBBCACCACCCCCBCABBBCABCA"
                    3⤵
                    • Launches sc.exe
                    PID:2520
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCCABBAAACABCBBBAAACABBBBCBBCACCACCCCCBCABBBCABCA"
                  2⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1628
                  • C:\Windows\SysWOW64\sc.exe
                    sc start "UserDataSvc_CBCCCABBAAACABCBBBAAACABBBBCBBCACCACCCCCBCABBBCABCA"
                    3⤵
                    • Launches sc.exe
                    PID:4968
              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCCACCCBCCCBCCBBBBCACCACCBCBCCABAACCCBAACBBCCCCBCBC.exe
                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCCACCCBCCCBCCBBBBCACCACCBCBCCABAACCCBAACBBCCCCBCBC.exe
                1⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1056
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBAAABCAACCABACCAACCCCCCAACBBCABCBCCBBACACAAACCABBCCCABABCAACAAACAACACBBBCAACCABBCBCCCBBBCBCBBCABBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBBCBBACBCBCBBBABBBABBAAAACBAAABAACCBACABAACBBBCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                  2⤵
                    PID:3700
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBAAABCAACCABACCAACCCCCCAACBBCABCBCCBBACACAAACCABBCCCABABCAACAAACAACACBBBCAACCABBCBCCCBBBCBCBBCABBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBBCBBACBCBCBBBABBBABBAAAACBAAABAACCBACABAACBBBCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Scheduled Task/Job: Scheduled Task
                      PID:4056
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAACCBCACBBBCACBBAACCBBCBBCBCCABACCAAACACCBCCBAABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBBCBBACBCBCBBBABBBABBAAAACBAAABAACCBACABAACBBBCCAC.exe" start= auto displayName= "UserDataSvc_AAACCBCACBBBCACBBAACCBBCBBCBCCABACCAAACACCBCCBAABCB"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:644
                    • C:\Windows\SysWOW64\sc.exe
                      sc create "UserDataSvc_AAACCBCACBBBCACBBAACCBBCBBCBCCABACCAAACACCBCCBAABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBBCBBACBCBCBBBABBBABBAAAACBAAABAACCBACABAACBBBCCAC.exe" start= auto displayName= "UserDataSvc_AAACCBCACBBBCACBBAACCBBCBBCBCCABACCAAACACCBCCBAABCB"
                      3⤵
                      • Launches sc.exe
                      PID:640
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAACCBCACBBBCACBBAACCBBCBBCBCCABACCAAACACCBCCBAABCB"
                    2⤵
                      PID:1772
                      • C:\Windows\SysWOW64\sc.exe
                        sc start "UserDataSvc_AAACCBCACBBBCACBBAACCBBCBBCBCCABACCAAACACCBCCBAABCB"
                        3⤵
                        • Launches sc.exe
                        PID:3196
                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCCAACCAACBABBBCCABABCABCCCCACABBCBACCBBCACCACBCBB.exe
                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCCAACCAACBABBBCCABABCABCCCCACABBCBACCBBCACCACBCBB.exe
                    1⤵
                    • Drops startup file
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3880
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABABBACABCBBCCBCBBAAAABACBBCCBBBBBABBAACCABCCAACBACBACABAAAACAABCCACCAAABBBBAAACABACCCBCBCCBCCBBBBCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBBCCABBCCBCABBABBBCABABBAACACBCABCBABACCBCCABABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:964
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABABBACABCBBCCBCBBAAAABACBBCCBBBBBABBAACCABCCAACBACBACABAAAACAABCCACCAAABBBBAAACABACCCBCBCCBCCBBBBCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBBCCABBCCBCABBABBBCABABBAACACBCABCBABACCBCCABABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                        3⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:3804
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCACCCCABBACACCBABCAABBBCCCBACCAAABBBACBABBBBCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBBCCABBCCBCABBABBBCABABBAACACBCABCBABACCBCCABABAAB.exe" start= auto displayName= "UserDataSvc_CBBCACCCCABBACACCBABCAABBBCCCBACCAAABBBACBABBBBCBAA"
                      2⤵
                        PID:5476
                        • C:\Windows\SysWOW64\sc.exe
                          sc create "UserDataSvc_CBBCACCCCABBACACCBABCAABBBCCCBACCAAABBBACBABBBBCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBBCCABBCCBCABBABBBCABABBAACACBCABCBABACCBCCABABAAB.exe" start= auto displayName= "UserDataSvc_CBBCACCCCABBACACCBABCAABBBCCCBACCAAABBBACBABBBBCBAA"
                          3⤵
                            PID:8
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCACCCCABBACACCBABCAABBBCCCBACCAAABBBACBABBBBCBAA"
                          2⤵
                            PID:6032
                            • C:\Windows\SysWOW64\sc.exe
                              sc start "UserDataSvc_CBBCACCCCABBACACCBABCAABBBCCCBACCAAABBBACBABBBBCBAA"
                              3⤵
                              • Launches sc.exe
                              PID:2944
                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCCAACCAACBABBBCCABABCABCCCCACABBCBACCBBCACCACBCBB.exe
                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCCAACCAACBABBBCCABABCABCCCCACABBCBACCBBCACCACBCBB.exe
                          1⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4860
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABABBBCBBACABBCBCCCBBBACACCCBCABBBCBAACACCBABBCAABCCBAAACCABAAABCACBAACCABBABCBACCACABACBABAAABBABCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCBCCAACBCCBAABABACBCCBABBBBACCCCCAABCBACBCBBACCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                            2⤵
                              PID:3708
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABABBBCBBACABBCBCCCBBBACACCCBCABBBCBAACACCBABBCAABCCBAAACCABAAABCACBAACCABBABCBACCACABACBABAAABBABCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCBCCAACBCCBAABABACBCCBABBBBACCCCCAABCBACBCBBACCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                3⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:5148
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCAAACBABACBBBCBBBBCBACBACBBABCBCACCBAABABCCAACAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCBCCAACBCCBAABABACBCCBABBBBACCCCCAABCBACBCBBACCCCB.exe" start= auto displayName= "UserDataSvc_BBCAAACBABACBBBCBBBBCBACBACBBABCBCACCBAABABCCAACAAA"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:1912
                              • C:\Windows\SysWOW64\sc.exe
                                sc create "UserDataSvc_BBCAAACBABACBBBCBBBBCBACBACBBABCBCACCBAABABCCAACAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCBCCAACBCCBAABABACBCCBABBBBACCCCCAABCBACBCBBACCCCB.exe" start= auto displayName= "UserDataSvc_BBCAAACBABACBBBCBBBBCBACBACBBABCBCACCBAABABCCAACAAA"
                                3⤵
                                • Launches sc.exe
                                PID:4244
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCAAACBABACBBBCBBBBCBACBACBBABCBCACCBAABABCCAACAAA"
                              2⤵
                                PID:4284
                                • C:\Windows\SysWOW64\sc.exe
                                  sc start "UserDataSvc_BBCAAACBABACBBBCBBBBCBACBACBBABCBCACCBAABABCCAACAAA"
                                  3⤵
                                  • Launches sc.exe
                                  PID:1604
                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACABBBAACCCBBBAAABCCABACACBCAAACBCBCCACBAABAABCAAAAC.exe
                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACABBBAACCCBBBAAABCCABACACBCAAACBCBCCACBAABAABCAAAAC.exe
                              1⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:2452
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACABACCBABCABACCBABCCCACCBBABABCBBAAACCBAAABCBCCCBABCBACCBBBABBACBCCACABCBCCAABCAABBCBBCBBBCCBBAAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCABBBABBAABBBABABACACCBACCCBCCCACBBBAABBBBABACCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1096
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACABACCBABCABACCBABCCCACCBBABABCBBAAACCBAAABCBCCCBABCBACCBBBABBACBCCACABCBCCAABCAABBCBBCBBBCCBBAAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCABBBABBAABBBABABACACCBACCCBCCCACBBBAABBBBABACCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                  3⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:5660
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBABABCABAACCACACCCAABBAACBCBAAABBBCACCACCACCABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCABBBABBAABBBABABACACCBACCCBCCCACBBBAABBBBABACCBCC.exe" start= auto displayName= "UserDataSvc_BCBABABCABAACCACACCCAABBAACBCBAAABBBCACCACCACCABCCC"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:4720
                                • C:\Windows\SysWOW64\sc.exe
                                  sc create "UserDataSvc_BCBABABCABAACCACACCCAABBAACBCBAAABBBCACCACCACCABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCABBBABBAABBBABABACACCBACCCBCCCACBBBAABBBBABACCBCC.exe" start= auto displayName= "UserDataSvc_BCBABABCABAACCACACCCAABBAACBCBAAABBBCACCACCACCABCCC"
                                  3⤵
                                  • Launches sc.exe
                                  PID:3956
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBABABCABAACCACACCCAABBAACBCBAAABBBCACCACCACCABCCC"
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2012
                                • C:\Windows\SysWOW64\sc.exe
                                  sc start "UserDataSvc_BCBABABCABAACCACACCCAABBAACBCBAAABBBCACCACCACCABCCC"
                                  3⤵
                                    PID:5884
                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCABBBABBAABBBABABACACCBACCCBCCCACBBBAABBBBABACCBCC.exe
                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCABBBABBAABBBABABACACCBACCCBCCCACBBBAABBBBABACCBCC.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1252
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBBCBABBCACAABBCCCBCBAACCBBBCCCCABCACACCAACCBACCCCCABBAACBAABACACAABABAAABCCABBBCCACBCBBBCCBCBBABBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBCCBCACCABCAABCCCCBBCACAACAACCCCCAAAABBAACCAABBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                  2⤵
                                    PID:5228
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBBCBABBCACAABBCCCBCBAACCBBBCCCCABCACACCAACCBACCCCCABBAACBAABACACAABABAAABCCABBBCCACBCBBBCCBCBBABBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBCCBCACCABCAABCCCCBBCACAACAACCCCCAAAABBAACCAABBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                      3⤵
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4436
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACACAACACABABACCBCBBACCACAACBCBCCAABAAABAAACBCABCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBCCBCACCABCAABCCCCBBCACAACAACCCCCAAAABBAACCAABBAC.exe" start= auto displayName= "UserDataSvc_ACACAACACABABACCBCBBACCACAACBCBCCAABAAABAAACBCABCBB"
                                    2⤵
                                      PID:5360
                                      • C:\Windows\SysWOW64\sc.exe
                                        sc create "UserDataSvc_ACACAACACABABACCBCBBACCACAACBCBCCAABAAABAAACBCABCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBCCBCACCABCAABCCCCBBCACAACAACCCCCAAAABBAACCAABBAC.exe" start= auto displayName= "UserDataSvc_ACACAACACABABACCBCBBACCACAACBCBCCAABAAABAAACBCABCBB"
                                        3⤵
                                        • Launches sc.exe
                                        PID:4632
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACACAACACABABACCBCBBACCACAACBCBCCAABAAABAAACBCABCBB"
                                      2⤵
                                        PID:3960
                                        • C:\Windows\SysWOW64\sc.exe
                                          sc start "UserDataSvc_ACACAACACABABACCBCBBACCACAACBCBCCAABAAABAAACBCABCBB"
                                          3⤵
                                          • Launches sc.exe
                                          • System Location Discovery: System Language Discovery
                                          PID:204
                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAACAABCBCABCBBBBCCACBACCACCABBAAABBAACBBCABBBCBCCBBB.exe
                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAACAABCBCABCBBBBCCACBACCACCABBAAABBAACBBCABBBCBCCBBB.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2872
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCABCABBACCABCCBACCBBBCABABCCABABABCBBBCAABCCBCABBABACABAACACACACCABBACCBAABBABCCAABCBBBCCCCABACBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBAABBAAACBCBBBCAABAAABBCCCBCAACAAAABAACACABCBCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                        2⤵
                                          PID:5388
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCABCABBACCABCCBACCBBBCABABCCABABABCBBBCAABCCBCABBABACABAACACACACCABBACCBAABBABCCAABCBBBCCCCABACBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBAABBAAACBCBBBCAABAAABBCCCBCAACAAAABAACACABCBCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                            3⤵
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4516
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCCBCAACAAAAACCACCCBCBBAACBABCBAACBACACBBCBCCAABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBAABBAAACBCBBBCAABAAABBCCCBCAACAAAABAACACABCBCCCBA.exe" start= auto displayName= "UserDataSvc_BCCCBCAACAAAAACCACCCBCBBAACBABCBAACBACACBBCBCCAABBB"
                                          2⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1660
                                          • C:\Windows\SysWOW64\sc.exe
                                            sc create "UserDataSvc_BCCCBCAACAAAAACCACCCBCBBAACBABCBAACBACACBBCBCCAABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBAABBAAACBCBBBCAABAAABBCCCBCAACAAAABAACACABCBCCCBA.exe" start= auto displayName= "UserDataSvc_BCCCBCAACAAAAACCACCCBCBBAACBABCBAACBACACBBCBCCAABBB"
                                            3⤵
                                            • Launches sc.exe
                                            PID:5904
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCCBCAACAAAAACCACCCBCBBAACBABCBAACBACACBBCBCCAABBB"
                                          2⤵
                                            PID:4356
                                            • C:\Windows\SysWOW64\sc.exe
                                              sc start "UserDataSvc_BCCCBCAACAAAAACCACCCBCBBAACBABCBAACBACACBBCBCCAABBB"
                                              3⤵
                                                PID:4624
                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBBCBBACBCBCBBBABBBABBAAAACBAAABAACCBACABAACBBBCCAC.exe
                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBBCBBACBCBCBBBABBBABBAAAACBAAABAACCBACABAACBBBCCAC.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3296
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBCCBBBABAAACCACCBCCCACACCACBAAAABABBCCAAABCCCAABCAAABCABBCAABCBAABCABBBAABCAAAABCBCBACACBBBCBBCCCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABBBCBCAAACBAABCBACBBBABCACBBBBABCBABBABAAACCCCCABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                              2⤵
                                                PID:5516
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBCCBBBABAAACCACCBCCCACACCACBAAAABABBCCAAABCCCAABCAAABCABBCAABCBAABCABBBAABCAAAABCBCBACACBBBCBBCCCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABBBCBCAAACBAABCBACBBBABCACBBBBABCBABBABAAACCCCCABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:5796
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCBCACBABBBAACBACCBBABCCCCABAAACAACACAABCBCCAAACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABBBCBCAAACBAABCBACBBBABCACBBBBABCBABBABAAACCCCCABAC.exe" start= auto displayName= "UserDataSvc_BBCBCACBABBBAACBACCBBABCCCCABAAACAACACAABCBCCAAACBC"
                                                2⤵
                                                  PID:2664
                                                  • C:\Windows\SysWOW64\sc.exe
                                                    sc create "UserDataSvc_BBCBCACBABBBAACBACCBBABCCCCABAAACAACACAABCBCCAAACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABBBCBCAAACBAABCBACBBBABCACBBBBABCBABBABAAACCCCCABAC.exe" start= auto displayName= "UserDataSvc_BBCBCACBABBBAACBACCBBABCCCCABAAACAACACAABCBCCAAACBC"
                                                    3⤵
                                                      PID:2076
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCBCACBABBBAACBACCBBABCCCCABAAACAACACAABCBCCAAACBC"
                                                    2⤵
                                                      PID:2496
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc start "UserDataSvc_BBCBCACBABBBAACBACCBBABCCCCABAAACAACACAABCBCCAAACBC"
                                                        3⤵
                                                          PID:5208
                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCBCCAACBCCBAABABACBCCBABBBBACCCCCAABCBACBCBBACCCCB.exe
                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCBCCAACBCCBAABABACBCCBABBBBACCCCCAABCBACBCBBACCCCB.exe
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:6136
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBBBCBABCCBBBBCBAABBBCBBBABCCBABACBCACBBCCBCCBCAAACBACCACCBCCABBCBCAABBCBAAACCCBACBACCAACACACCCBABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCAACCCACACBCCCABCCACBCABBCBAABBABCCBAABBBBCBCCACCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                        2⤵
                                                          PID:2880
                                                          • C:\Windows\System32\Conhost.exe
                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            3⤵
                                                              PID:4056
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBBBCBABCCBBBBCBAABBBCBBBABCCBABACBCACBBCCBCCBCAAACBACCACCBCCABBCBCAABBCBAAACCCBACBACCAACACACCCBABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCAACCCACACBCCCABCCACBCABBCBAABBABCCBAABBBBCBCCACCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                              3⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:4372
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCAAABAABBABCBACABCAACBCBACCABBAABBAAACBBBCABBABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCAACCCACACBCCCABCCACBCABBCBAABBABCCBAABBBBCBCCACCCC.exe" start= auto displayName= "UserDataSvc_ABCAAABAABBABCBACABCAACBCBACCABBAABBAAACBBBCABBABAA"
                                                            2⤵
                                                              PID:5852
                                                              • C:\Windows\SysWOW64\sc.exe
                                                                sc create "UserDataSvc_ABCAAABAABBABCBACABCAACBCBACCABBAABBAAACBBBCABBABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCAACCCACACBCCCABCCACBCABBCBAABBABCCBAABBBBCBCCACCCC.exe" start= auto displayName= "UserDataSvc_ABCAAABAABBABCBACABCAACBCBACCABBAABBAAACBBBCABBABAA"
                                                                3⤵
                                                                • Launches sc.exe
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2216
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCAAABAABBABCBACABCAACBCBACCABBAABBAAACBBBCABBABAA"
                                                              2⤵
                                                                PID:4064
                                                                • C:\Windows\SysWOW64\sc.exe
                                                                  sc start "UserDataSvc_ABCAAABAABBABCBACABCAACBCBACCABBAABBAAACBBBCABBABAA"
                                                                  3⤵
                                                                    PID:5864
                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBBCCABBCCBCABBABBBCABABBAACACBCABCBABACCBCCABABAAB.exe
                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBBCCABBCCBCABBABBBCABABBAACACBCABCBABACCBCCABABAAB.exe
                                                                1⤵
                                                                • Drops startup file
                                                                • Executes dropped EXE
                                                                • Adds Run key to start application
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2776
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBCBBACCBBBCBCCBCABCAABCBCBCACACBBAAAABCBCABBBCBACACACBBBACBABCAACAAAAABBABABCBAABBCACBBCBAABCAACCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAAABBBBCAACAABCACABCBCBCAABACAABCBABABCBABBCAABBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                  2⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:1704
                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBCBBACCBBBCBCCBCABCAABCBCBCACACBBAAAABCBCABBBCBACACACBBBACBABCAACAAAAABBABABCBAABBCACBBCBAABCAACCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAAABBBBCAACAABCACABCBCBCAABACAABCBABABCBABBCAABBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                    3⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:876
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACACBBBABBACCCBACABBAABAABACCBBACACCACCBAAACCAAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAAABBBBCAACAABCACABCBCBCAABACAABCBABABCBABBCAABBACC.exe" start= auto displayName= "UserDataSvc_BACACBBBABBACCCBACABBAABAABACCBBACACCACCBAAACCAAABA"
                                                                  2⤵
                                                                    PID:5696
                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                      sc create "UserDataSvc_BACACBBBABBACCCBACABBAABAABACCBBACACCACCBAAACCAAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAAABBBBCAACAABCACABCBCBCAABACAABCBABABCBABBCAABBACC.exe" start= auto displayName= "UserDataSvc_BACACBBBABBACCCBACABBAABAABACCBBACACCACCBAAACCAAABA"
                                                                      3⤵
                                                                      • Launches sc.exe
                                                                      PID:5640
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACACBBBABBACCCBACABBAABAABACCBBACACCACCBAAACCAAABA"
                                                                    2⤵
                                                                      PID:4904
                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                        sc start "UserDataSvc_BACACBBBABBACCCBACABBAABAABACCBBACACCACCBAAACCAAABA"
                                                                        3⤵
                                                                        • Launches sc.exe
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:6080
                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBBCCABBCCBCABBABBBCABABBAACACBCABCBABACCBCCABABAAB.exe
                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBBCCABBCCBCABBABBBCABABBAACACBCABCBABACCBCCABABAAB.exe
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:5428
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBCCBABCCBBCCCABBCBBCBCBACCAAACBABBAACBCAACACACCBABCAABACBABBCCBABACCABCCAABACBBCABACCABABACABACBBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCACCBBACCCABACABBACBBBACBCBCBCACBABCABABBBBAABCBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                      2⤵
                                                                        PID:1552
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBCCBABCCBBCCCABBCBBCBCBACCAAACBABBAACBCAACACACCBABCAABACBABBCCBABACCABCCAABACBBCABACCABABACABACBBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCACCBBACCCABACABBACBBBACBCBCBCACBABCABABBBBAABCBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                          3⤵
                                                                          • Scheduled Task/Job: Scheduled Task
                                                                          PID:1120
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBBBBCBBABACBAACACBBBBAAABBBCCAABCAABACCACAABCCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCACCBBACCCABACABBACBBBACBCBCBCACBABCABABBBBAABCBCCA.exe" start= auto displayName= "UserDataSvc_ACBBBBCBBABACBAACACBBBBAAABBBCCAABCAABACCACAABCCAAA"
                                                                        2⤵
                                                                          PID:4268
                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                            sc create "UserDataSvc_ACBBBBCBBABACBAACACBBBBAAABBBCCAABCAABACCACAABCCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCACCBBACCCABACABBACBBBACBCBCBCACBABCABABBBBAABCBCCA.exe" start= auto displayName= "UserDataSvc_ACBBBBCBBABACBAACACBBBBAAABBBCCAABCAABACCACAABCCAAA"
                                                                            3⤵
                                                                              PID:5152
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBBBBCBBABACBAACACBBBBAAABBBCCAABCAABACCACAABCCAAA"
                                                                            2⤵
                                                                              PID:8
                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                sc start "UserDataSvc_ACBBBBCBBABACBAACACBBBBAAABBBCCAABCAABACCACAABCCAAA"
                                                                                3⤵
                                                                                  PID:4596
                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCAACCCACACBCCCABCCACBCABBCBAABBABCCBAABBBBCBCCACCCC.exe
                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCAACCCACACBCCCABCCACBCABBCBAABBABCCBAABBBBCBCCACCCC.exe
                                                                              1⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:764
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACABACBCABACBCCBCAAACBACBBBBCCCBAACCABABACBABCBCCCACACACABCCCCBACAACBCCBBCCACACABABCABBCCCCCCAABABBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBABACCABBBCBBCACAABAABCAABACCABBBABCBBAABCACCCCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                2⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5944
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACABACBCABACBCCBCAAACBACBBBBCCCBAACCABABACBABCBCCCACACACABCCCCBACAACBCCBBCCACACABABCABBCCCCCCAABABBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBABACCABBBCBBCACAABAABCAABACCABBBABCBBAABCACCCCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                  3⤵
                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                  PID:176
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABABAABBBCAAACCCBBACACAABCAABAACBBCBBBAAABCCCBACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBABACCABBBCBBCACAABAABCAABACCABBBABCBBAABCACCCCAAC.exe" start= auto displayName= "UserDataSvc_CABABAABBBCAAACCCBBACACAABCAABAACBBCBBBAAABCCCBACAA"
                                                                                2⤵
                                                                                  PID:5084
                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                    sc create "UserDataSvc_CABABAABBBCAAACCCBBACACAABCAABAACBBCBBBAAABCCCBACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBABACCABBBCBBCACAABAABCAABACCABBBABCBBAABCACCCCAAC.exe" start= auto displayName= "UserDataSvc_CABABAABBBCAAACCCBBACACAABCAABAACBBCBBBAAABCCCBACAA"
                                                                                    3⤵
                                                                                      PID:5596
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABABAABBBCAAACCCBBACACAABCAABAACBBCBBBAAABCCCBACAA"
                                                                                    2⤵
                                                                                      PID:2996
                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                        sc start "UserDataSvc_CABABAABBBCAAACCCBBACACAABCAABAACBBCBBBAAABCCCBACAA"
                                                                                        3⤵
                                                                                          PID:3596
                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAAABBBBCAACAABCACABCBCBCAABACAABCBABABCBABBCAABBACC.exe
                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAAABBBBCAACAABCACABCBCBCAABACAABCBABABCBABBCAABBACC.exe
                                                                                      1⤵
                                                                                      • Drops startup file
                                                                                      • Executes dropped EXE
                                                                                      • Adds Run key to start application
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:5180
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCACABCCBBABCACBBACBCAACABCBCACBCCBABCCCACBCCBCAAACBCCBCACBACCCCBBBBACCCCAABBBBACCCBCBBBCBBAABCCBACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACACAAABCCBBBCBABABBBBBACCBBBCAACAABACABABABCCACAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                        2⤵
                                                                                          PID:5400
                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCACABCCBBABCACBBACBCAACABCBCACBCCBABCCCACBCCBCAAACBCCBCACBACCCCBBBBACCCCAABBBBACCCBCBBBCBBAABCCBACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACACAAABCCBBBCBABABBBBBACCBBBCAACAABACABABABCCACAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                            3⤵
                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                            PID:5640
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCAABBACCBCBACABCACACAABBCABBABBABAACBCABABBBCBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACACAAABCCBBBCBABABBBBBACCBBBCAACAABACABABABCCACAABAC.exe" start= auto displayName= "UserDataSvc_CBCAABBACCBCBACABCACACAABBCABBABBABAACBCABABBBCBBCC"
                                                                                          2⤵
                                                                                            PID:2632
                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                              sc create "UserDataSvc_CBCAABBACCBCBACABCACACAABBCABBABBABAACBCABABBBCBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACACAAABCCBBBCBABABBBBBACCBBBCAACAABACABABABCCACAABAC.exe" start= auto displayName= "UserDataSvc_CBCAABBACCBCBACABCACACAABBCABBABBABAACBCABABBBCBBCC"
                                                                                              3⤵
                                                                                              • Launches sc.exe
                                                                                              PID:4820
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCAABBACCBCBACABCACACAABBCABBABBABAACBCABABBBCBBCC"
                                                                                            2⤵
                                                                                              PID:2008
                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                sc start "UserDataSvc_CBCAABBACCBCBACABCACACAABBCABBABBABAACBCABABBBCBBCC"
                                                                                                3⤵
                                                                                                • Launches sc.exe
                                                                                                PID:3356
                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAAABBBBCAACAABCACABCBCBCAABACAABCBABABCBABBCAABBACC.exe
                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAAABBBBCAACAABCACABCBCBCAABACAABCBABABCBABBCAABBACC.exe
                                                                                            1⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in System32 directory
                                                                                            • Drops file in Program Files directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:3240
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBCBABBCBCABBCCBBCAABABACBAAAABAABACABACCBBABBCBACBBBAACBCACCCBABACCCCCBACACCCBACAACABBBBBBCABBABCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCAABBCABCCBCBBBCCACCACCCACBCBCBBCCBBCACABCACAACAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                              2⤵
                                                                                                PID:1872
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBCBABBCBCABBCCBBCAABABACBAAAABAABACABACCBBABBCBACBBBAACBCACCCBABACCCCCBACACCCBACAACABBBBBBCABBABCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCAABBCABCCBCBBBCCACCACCCACBCBCBBCCBBCACABCACAACAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                  3⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:5468
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCCAAAAACBCCAAACCCCACCCBCBAAAABCAABCACBBCAAAAAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCAABBCABCCBCBBBCCACCACCCACBCBCBBCCBBCACABCACAACAAB.exe" start= auto displayName= "UserDataSvc_BCBCCAAAAACBCCAAACCCCACCCBCBAAAABCAABCACBBCAAAAAAAB"
                                                                                                2⤵
                                                                                                  PID:6088
                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                    sc create "UserDataSvc_BCBCCAAAAACBCCAAACCCCACCCBCBAAAABCAABCACBBCAAAAAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCAABBCABCCBCBBBCCACCACCCACBCBCBBCCBBCACABCACAACAAB.exe" start= auto displayName= "UserDataSvc_BCBCCAAAAACBCCAAACCCCACCCBCBAAAABCAABCACBBCAAAAAAAB"
                                                                                                    3⤵
                                                                                                      PID:5640
                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCACCBBACCCABACABBACBBBACBCBCBCACBABCABABBBBAABCBCCA.exe
                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCACCBBACCCABACABBACBBBACBCBCBCACBABCABABBBBAABCBCCA.exe
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:4572
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBAACBCCAAABABABCBACCBACACCBCACCCCBACBACABABBABBCBCBBABCAAABBBBCBBBCABBBAAABABACCCBCCCBBBAACBAAACCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBABCBAAABACAACAACCAACBCACCACBCCCBCACACBBACBBCBBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                    2⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:3820
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBAACBCCAAABABABCBACCBACACCBCACCCCBACBACABABBABBCBCBBABCAAABBBBCBBBCABBBAAABABACCCBCCCBBBAACBAAACCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBABCBAAABACAACAACCAACBCACCACBCCCBCACACBBACBBCBBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                      3⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                      PID:5376
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACCACBACCCCACBBBACBCBBCBBACCACCCCAABACBCCAACABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBABCBAAABACAACAACCAACBCACCACBCCCBCACACBBACBBCBBBBB.exe" start= auto displayName= "UserDataSvc_ABACCACBACCCCACBBBACBCBBCBBACCACCCCAABACBCCAACABBAB"
                                                                                                    2⤵
                                                                                                      PID:4892
                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                        sc create "UserDataSvc_ABACCACBACCCCACBBBACBCBBCBBACCACCCCAABACBCCAACABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBABCBAAABACAACAACCAACBCACCACBCCCBCACACBBACBBCBBBBB.exe" start= auto displayName= "UserDataSvc_ABACCACBACCCCACBBBACBCBBCBBACCACCCCAABACBCCAACABBAB"
                                                                                                        3⤵
                                                                                                          PID:2044
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACCACBACCCCACBBBACBCBBCBBACCACCCCAABACBCCAACABBAB"
                                                                                                        2⤵
                                                                                                          PID:5688
                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                            sc start "UserDataSvc_ABACCACBACCCCACBBBACBCBBCBBACCACCCCAABACBCCAACABBAB"
                                                                                                            3⤵
                                                                                                            • Launches sc.exe
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:4152
                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBCCBCACCABCAABCCCCBBCACAACAACCCCCAAAABBAACCAABBAC.exe
                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBCCBCACCABCAABCCCCBBCACAACAACCCCCAAAABBAACCAABBAC.exe
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:212
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBABBBCCBAABBBACBCBCAACACAABCCCCCCBCCBABCBCAABACCCABAACBBCBAABACACAAAAACCBABBBBBCAABCABBCBCCAABCCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBBCBABACBAABBCBBBBBABCABCAACBBACCABABCACBAACCCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                          2⤵
                                                                                                            PID:876
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBABBBCCBAABBBACBCBCAACACAABCCCCCCBCCBABCBCAABACCCABAACBBCBAABACACAAAAACCBABBBBBCAABCABBCBCCAABCCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBBCBABACBAABBCBBBBBABCABCAACBBACCABABCACBAACCCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                              3⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                              PID:3512
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBBAABACBCAABBCCACBACACCCBBBCCAACCCCBCBABACBABCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBBCBABACBAABBCBBBBBABCABCAACBBACCABABCACBAACCCBBC.exe" start= auto displayName= "UserDataSvc_BBBBAABACBCAABBCCACBACACCCBBBCCAACCCCBCBABACBABCABB"
                                                                                                            2⤵
                                                                                                              PID:4244
                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                3⤵
                                                                                                                  PID:5152
                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                  sc create "UserDataSvc_BBBBAABACBCAABBCCACBACACCCBBBCCAACCCCBCBABACBABCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBBCBABACBAABBCBBBBBABCABCAACBBACCABABCACBAACCCBBC.exe" start= auto displayName= "UserDataSvc_BBBBAABACBCAABBCCACBACACCCBBBCCAACCCCBCBABACBABCABB"
                                                                                                                  3⤵
                                                                                                                  • Launches sc.exe
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:4224
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBBAABACBCAABBCCACBACACCCBBBCCAACCCCBCBABACBABCABB"
                                                                                                                2⤵
                                                                                                                  PID:376
                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                    sc start "UserDataSvc_BBBBAABACBCAABBCCACBACACCCBBBCCAACCCCBCBABACBABCABB"
                                                                                                                    3⤵
                                                                                                                    • Launches sc.exe
                                                                                                                    PID:3876
                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBCCBCACCABCAABCCCCBBCACAACAACCCCCAAAABBAACCAABBAC.exe
                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBCCBCACCABCAABCCCCBBCACAACAACCCCCAAAABBAACCAABBAC.exe
                                                                                                                1⤵
                                                                                                                • Drops startup file
                                                                                                                • Executes dropped EXE
                                                                                                                • Adds Run key to start application
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:216
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACBBBCABBCCBCCBABBCBAAAABCCCBBCAABCBBCCAAAACACCCCCACCAABCABAACCCBCBBABCCBCBACCCAACCAAAAAACACCAACBCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAAABACBCCCCBCBACCCABBACCCBBACCACBBBACBACCCAABCBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                  2⤵
                                                                                                                    PID:3856
                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACBBBCABBCCBCCBABBCBAAAABCCCBBCAABCBBCCAAAACACCCCCACCAABCABAACCCBCBBABCCBCBACCCAACCAAAAAACACCAACBCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAAABACBCCCCBCBACCCABBACCCBBACCACBBBACBACCCAABCBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                      3⤵
                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                      PID:6072
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAACAACCCBCCBBCBCAABCBAACCBBBBCBAACCCBAABABBAAACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAAABACBCCCCBCBACCCABBACCCBBACCACBBBACBACCCAABCBBBC.exe" start= auto displayName= "UserDataSvc_ABAACAACCCBCCBBCBCAABCBAACCBBBBCBAACCCBAABABBAAACAB"
                                                                                                                    2⤵
                                                                                                                      PID:2044
                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                        sc create "UserDataSvc_ABAACAACCCBCCBBCBCAABCBAACCBBBBCBAACCCBAABABBAAACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAAABACBCCCCBCBACCCABBACCCBBACCACBBBACBACCCAABCBBBC.exe" start= auto displayName= "UserDataSvc_ABAACAACCCBCCBBCBCAABCBAACCBBBBCBAACCCBAABABBAAACAB"
                                                                                                                        3⤵
                                                                                                                          PID:3972
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAACAACCCBCCBBCBCAABCBAACCBBBBCBAACCCBAABABBAAACAB"
                                                                                                                        2⤵
                                                                                                                          PID:1668
                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                            sc start "UserDataSvc_ABAACAACCCBCCBBCBCAABCBAACCBBBBCBAACCCBAABABBAAACAB"
                                                                                                                            3⤵
                                                                                                                              PID:4932
                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABBBCBCAAACBAABCBACBBBABCACBBBBABCBABBABAAACCCCCABAC.exe
                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABBBCBCAAACBAABCBACBBBABCACBBBBABCBABBABAAACCCCCABAC.exe
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:5620
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABACBAABCACCAAACACBAABACCBAACCCAABCBCBCACACACBACAACCBABAACBABBCBBCABCCACACCAACACBAABCCCBBCBCCBCCAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAAACACABCACBCCAAAACBBCCCBBCBBCABCBABBBBBBCCCCBACACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                            2⤵
                                                                                                                              PID:5824
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABACBAABCACCAAACACBAABACCBAACCCAABCBCBCACACACBACAACCBABAACBABBCBBCABCCACACCAACACBAABCCCBBCBCCBCCAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAAACACABCACBCCAAAACBBCCCBBCBBCABCBABBBBBBCCCCBACACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                3⤵
                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                PID:3156
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCBABACCBACCAABCCBBCBACCBBCACCBBCACBBCCBBACCBCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAAACACABCACBCCAAAACBBCCCBBCBBCABCBABBBBBBCCCCBACACAB.exe" start= auto displayName= "UserDataSvc_CACCBABACCBACCAABCCBBCBACCBBCACCBBCACBBCCBBACCBCAAB"
                                                                                                                              2⤵
                                                                                                                                PID:4060
                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                  sc create "UserDataSvc_CACCBABACCBACCAABCCBBCBACCBBCACCBBCACBBCCBBACCBCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAAACACABCACBCCAAAACBBCCCBBCBBCABCBABBBBBBCCCCBACACAB.exe" start= auto displayName= "UserDataSvc_CACCBABACCBACCAABCCBBCBACCBBCACCBBCACBBCCBBACCBCAAB"
                                                                                                                                  3⤵
                                                                                                                                    PID:1840
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCBABACCBACCAABCCBBCBACCBBCACCBBCACBBCCBBACCBCAAB"
                                                                                                                                  2⤵
                                                                                                                                    PID:3972
                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                      sc start "UserDataSvc_CACCBABACCBACCAABCCBBCBACCBBCACCBBCACBBCCBBACCBCAAB"
                                                                                                                                      3⤵
                                                                                                                                        PID:2028
                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBABCBAAABACAACAACCAACBCACCACBCCCBCACACBBACBBCBBBBB.exe
                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBABCBAAABACAACAACCAACBCACCACBCCCBCACACBBACBBCBBBBB.exe
                                                                                                                                    1⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:1820
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCAACAAABCAAACABAACACAACCBACCCCACBAABBBBCCACCCBAACAACBAAACCABACACCABBBCBAACABCCCBACAABCBBCAAABBCACABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACAAABCAAACABAACACAACCBACCCCACBAABBBBCCACCCBAACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                      2⤵
                                                                                                                                        PID:5424
                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCAACAAABCAAACABAACACAACCBACCCCACBAABBBBCCACCCBAACAACBAAACCABACACCABBBCBAACABCCCBACAABCBBCAAABBCACABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACAAABCAAACABAACACAACCBACCCCACBAABBBBCCACCCBAACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                          3⤵
                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                          PID:4868
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCAAABCBCBBBCCBCACCABCACBBBBCBCABCBCAACCBBABBCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACAAABCAAACABAACACAACCBACCCCACBAABBBBCCACCCBAACAAC.exe" start= auto displayName= "UserDataSvc_CCCCAAABCBCBBBCCBCACCABCACBBBBCBCABCBCAACCBBABBCCCC"
                                                                                                                                        2⤵
                                                                                                                                          PID:4004
                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                            sc create "UserDataSvc_CCCCAAABCBCBBBCCBCACCABCACBBBBCBCABCBCAACCBBABBCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACAAABCAAACABAACACAACCBACCCCACBAABBBBCCACCCBAACAAC.exe" start= auto displayName= "UserDataSvc_CCCCAAABCBCBBBCCBCACCABCACBBBBCBCABCBCAACCBBABBCCCC"
                                                                                                                                            3⤵
                                                                                                                                            • Launches sc.exe
                                                                                                                                            PID:4204
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCAAABCBCBBBCCBCACCABCACBBBBCBCABCBCAACCBBABBCCCC"
                                                                                                                                          2⤵
                                                                                                                                            PID:4828
                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                              sc start "UserDataSvc_CCCCAAABCBCBBBCCBCACCABCACBBBBCBCABCBCAACCBBABBCCCC"
                                                                                                                                              3⤵
                                                                                                                                              • Launches sc.exe
                                                                                                                                              PID:1848
                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBAABBAAACBCBBBCAABAAABBCCCBCAACAAAABAACACABCBCCCBA.exe
                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBAABBAAACBCBBBCAABAAABBCCCBCAACAAAABAACACABCBCCCBA.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:1464
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACABCACBACAACAAAABCABABABCBCCABACAABBAAABCABBCBCCAABCCACABACBBCCABAAAACACBAABCACABABABACABACAAACCAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACAAABCAAACABAACACAACCBACCCCACBAABBBBCCACCCBAACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                            2⤵
                                                                                                                                              PID:5844
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACABCACBACAACAAAABCABABABCBCCABACAABBAAABCABBCBCCAABCCACABACBBCCABAAAACACBAABCACABABABACABACAAACCAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACAAABCAAACABAACACAACCBACCCCACBAABBBBCCACCCBAACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                3⤵
                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                PID:728
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCCAAAAACBCCAAACCCCACCCBCBAAAABCAABCACBBCAAAAAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACAAABCAAACABAACACAACCBACCCCACBAABBBBCCACCCBAACAAC.exe" start= auto displayName= "UserDataSvc_BCBCCAAAAACBCCAAACCCCACCCBCBAAAABCAABCACBBCAAAAAAAB"
                                                                                                                                              2⤵
                                                                                                                                                PID:444
                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                  sc create "UserDataSvc_BCBCCAAAAACBCCAAACCCCACCCBCBAAAABCAABCACBBCAAAAAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACAAABCAAACABAACACAACCBACCCCACBAABBBBCCACCCBAACAAC.exe" start= auto displayName= "UserDataSvc_BCBCCAAAAACBCCAAACCCCACCCBCBAAAABCAABCACBBCAAAAAAAB"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:3676
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCCAAAAACBCCAAACCCCACCCBCBAAAABCAABCACBBCAAAAAAAB"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:3328
                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                      sc start "UserDataSvc_BCBCCAAAAACBCCAAACCCCACCCBCBAAAABCAABCACBBCAAAAAAAB"
                                                                                                                                                      3⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      PID:2072
                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAAABACBCCCCBCBACCCABBACCCBBACCACBBBACBACCCAABCBBBC.exe
                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAAABACBCCCCBCBACCCABBACCCBBACCACBBBACBACCCAABCBBBC.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Drops startup file
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:5264
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACBCCBBCCCCABABCABABABABCCBCAAACACBABCACAAAABABBABBCBBAAAACBCBBCCABBBBCBCBACACBCAAAACCBBABACCAABBBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCBCCBBCABCBCCAACABAABCCABBACCACABBABBABCCBABAAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                    2⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:3664
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACBCCBBCCCCABABCABABABABCCBCAAACACBABCACAAAABABBABBCBBAAAACBCBBCCABBBBCBCBACACBCAAAACCBBABACCAABBBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCBCCBBCABCBCCAACABAABCCABBACCACABBABBABCCBABAAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                      3⤵
                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                      PID:3740
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCBCCCABCACAAABBCBAABBCCABBABCBCBBCACCBCCCCBBCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCBCCBBCABCBCCAACABAABCCABBACCACABBABBABCCBABAAAAAB.exe" start= auto displayName= "UserDataSvc_ACBCBCCCABCACAAABBCBAABBCCABBABCBCBBCACCBCCCCBBCCBB"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3368
                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                        sc create "UserDataSvc_ACBCBCCCABCACAAABBCBAABBCCABBABCBCBBCACCBCCCCBBCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCBCCBBCABCBCCAACABAABCCABBACCACABBABBABCCBABAAAAAB.exe" start= auto displayName= "UserDataSvc_ACBCBCCCABCACAAABBCBAABBCCABBABCBCBBCACCBCCCCBBCCBB"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1176
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCBCCCABCACAAABBCBAABBCCABBABCBCBBCACCBCCCCBBCCBB"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:5124
                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                            3⤵
                                                                                                                                                              PID:884
                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                              sc start "UserDataSvc_ACBCBCCCABCACAAABBCBAABBCCABBABCBCBBCACCBCCCCBBCCBB"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2792
                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBBCBABACBAABBCBBBBBABCABCAACBBACCABABCACBAACCCBBC.exe
                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBBCBABACBAABBCBBBBBABCABCAACBBACCABABCACBAACCCBBC.exe
                                                                                                                                                            1⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:1352
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCABBCBBCCCBBAABCCCBABCBAAABAABCACCCBBCACBBCCACAAACABBCAACCACAACBBCCCCACACCBCBBAACABBCCCACCBCACABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABBCBBCCCBBAABCCCBABCBAAABAABCACCCBBCACBBCCACAAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1944
                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCABBCBBCCCBBAABCCCBABCBAAABAABCACCCBBCACBBCCACAAACABBCAACCACAACBBCCCCACACCBCBBAACABBCCCACCBCACABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABBCBBCCCBBAABCCCBABCBAAABAABCACCCBBCACBBCCACAAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                  3⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                  PID:884
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCCAABBABCCAAACACACACCBBABACCCCBCBBBAAAAAAACABBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABBCBBCCCBBAABCCCBABCBAAABAABCACCCBBCACBBCCACAAACA.exe" start= auto displayName= "UserDataSvc_BABCCAABBABCCAAACACACACCBBABACCCCBCBBBAAAAAAACABBBA"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:3740
                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                    sc create "UserDataSvc_BABCCAABBABCCAAACACACACCBBABACCCCBCBBBAAAAAAACABBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABBCBBCCCBBAABCCCBABCBAAABAABCACCCBBCACBBCCACAAACA.exe" start= auto displayName= "UserDataSvc_BABCCAABBABCCAAACACACACCBBABACCCCBCBBBAAAAAAACABBBA"
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                    PID:3156
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABCCAABBABCCAAACACACACCBBABACCCCBCBBBAAAAAAACABBBA"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1948
                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                      sc start "UserDataSvc_BABCCAABBABCCAAACACACACCBBABACCCCBCBBBAAAAAAACABBBA"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:6192
                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBBCBABACBAABBCBBBBBABCABCAACBBACCABABCACBAACCCBBC.exe
                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBBCBABACBAABBCBBBBBABCABCAACBBACCABABCACBAACCCBBC.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                    • Drops startup file
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                    PID:4332
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAABCAABAAACCACCBCACBABBBCCBACBBBBCBCBCABCBAABBCABCAABCBCACAABAABCBBACAAAABAAACBBAABACCACABBACACCCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABCABCACBACCCABBBABAABBCCAABAACCCCBBBABCABBCCACABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:4756
                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAABCAABAAACCACCBCACBABBBCCBACBBBBCBCBCABCBAABBCABCAABCBCACAABAABCBBACAAAABAAACBBAABACCACABBACACCCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABCABCACBACCCABBBABAABBCCAABAACCCCBBBABCABBCCACABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                          3⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                          PID:5344
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCABACBCBCCACACABBABCCACBCACCACBBCCCCBCACCAACCBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABCABCACBACCCABBBABAABBCCAABAACCCCBBBABCABBCCACABAC.exe" start= auto displayName= "UserDataSvc_CCCABACBCBCCACACABBABCCACBCACCACBBCCCCBCACCAACCBABA"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:6248
                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                            sc create "UserDataSvc_CCCABACBCBCCACACABBABCCACBCACCACBBCCCCBCACCAACCBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABCABCACBACCCABBBABAABBCCAABAACCCCBBBABCABBCCACABAC.exe" start= auto displayName= "UserDataSvc_CCCABACBCBCCACACABBABCCACBCACCACBBCCCCBCACCAACCBABA"
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:6320
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCABACBCBCCACACABBABCCACBCACCACBBCCCCBCACCAACCBABA"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:6348
                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                              sc start "UserDataSvc_CCCABACBCBCCACACABBABCCACBCACCACBBCCCCBCACCAACCBABA"
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                              PID:6400
                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAAABACBCCCCBCBACCCABBACCCBBACCACBBBACBACCCAABCBBBC.exe
                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAAABACBCCCCBCBACCCABBACCCBBACCACBBBACBACCCAABCBBBC.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:4744
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBCCBCABCCCAACABCBACACBAABCBCBACCABBAACBCCACAAAACCBBCBCBBCBABCBCBBBBBACBBBACBCCBABBCBAACCBBBABBCCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBBABAACCCCABABAABABBAAACAABBBCCBACBBCABBCABBABBCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:6672
                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBCCBCABCCCAACABCBACACBAABCBCBACCABBAACBCCACAAAACCBBCBCBBCBABCBCBBBBBACBBBACBCCBABBCBAACCBBBABBCCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBBABAACCCCABABAABABBAAACAABBBCCBACBBCABBCABBABBCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                PID:6764
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBABCACCABCABBABBCBAAABAABABAABAABCAACBAAABAACACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBBABAACCCCABABAABABBAAACAABBBCCBACBBCABBCABBABBCACA.exe" start= auto displayName= "UserDataSvc_CCBABCACCABCABBABBCBAAABAABABAABAABCAACBAAABAACACCB"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:6816
                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                  sc create "UserDataSvc_CCBABCACCABCABBABBCBAAABAABABAABAABCAACBAAABAACACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBBABAACCCCABABAABABBAAACAABBBCCBACBBCABBCABBABBCACA.exe" start= auto displayName= "UserDataSvc_CCBABCACCABCABBABBCBAAABAABABAABAABCAACBAAABAACACCB"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                  PID:6864
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBABCACCABCABBABBCBAAABAABABAABAABCAACBAAABAACACCB"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:6880
                                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                    sc start "UserDataSvc_CCBABCACCABCABBABBCBAAABAABABAABAABCAACBAAABAACACCB"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                    PID:6924
                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBABACCABBBCBBCACAABAABCAABACCABBBABCBBAABCACCCCAAC.exe
                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBABACCABBBCBBCACAABAABCAABACCABBBABCBBAABCACCCCAAC.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                PID:828
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCCCAACBCBBCBAAACBABBBBBBBCBCACBBACBACBAABACACCBCABCBCBBBABBCCACACBCCCBCCCCBABAAACBACACCCCBBCBCACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCBABBCBBCBABCCCACCABAABACBCBABAACAACCBABBCACBBCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:5580
                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCCCAACBCBBCBAAACBABBBBBBBCBCACBBACBACBAABACACCBCABCBCBBBABBCCACACBCCCBCCCCBABAAACBACACCCCBBCBCACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCBABBCBBCBABCCCACCABAABACBCBABAACAACCBABBCACBBCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                      PID:4804
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBBCACCAAACBACBCBBBAABABAAAACACACCBCCCCBAAACCABCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCBABBCBBCBABCCCACCABAABACBCBABAACAACCBABBCACBBCABC.exe" start= auto displayName= "UserDataSvc_ACBBCACCAAACBACBCBBBAABABAAAACACACCBCCCCBAAACCABCAC"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:5392
                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                        sc create "UserDataSvc_ACBBCACCAAACBACBCBBBAABABAAAACACACCBCCCCBAAACCABCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCBABBCBBCBABCCCACCABAABACBCBABAACAACCBABBCACBBCABC.exe" start= auto displayName= "UserDataSvc_ACBBCACCAAACBACBCBBBAABABAAAACACACCBCCCCBAAACCABCAC"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                        PID:5892
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBBCACCAAACBACBCBBBAABABAAAACACACCBCCCCBAAACCABCAC"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:4992
                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                          sc start "UserDataSvc_ACBBCACCAAACBACBCBBBAABABAAAACACACCBCCCCBAAACCABCAC"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:3592
                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAAACACABCACBCCAAAACBBCCCBBCBBCABCBABBBBBBCCCCBACACAB.exe
                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAAACACABCACBCCAAAACBBCCCBBCBBCABCBABBBBBBCCCCBACACAB.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                        PID:5044
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABAAAAACABBCBBCBAABCBBBCABBAAAAAACAACBBBCBBABCBCBBBCCCBCCACABAACBAAAAAABACCCCACACCCBCBBABBCACCCABBBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCAACBAAAAABACABCABBCCCBBBAACCBAABCACBACAACBCABABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:6472
                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABAAAAACABBCBBCBAABCBBBCABBAAAAAACAACBBBCBBABCBCBBBCCCBCCACABAACBAAAAAABACCCCACACCCBCBBABBCACCCABBBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCAACBAAAAABACABCABBCCCBBBAACCBAABCACBACAACBCABABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                              PID:6528
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAABCBCBBCBACCCBCCCACACBABCABCCBCABBBAABACCBCBACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCAACBAAAAABACABCABBCCCBBBAACCBAABCACBACAACBCABABABA.exe" start= auto displayName= "UserDataSvc_CAAABCBCBBCBACCCBCCCACACBABCABCCBCABBBAABACCBCBACAC"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:6548
                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                sc create "UserDataSvc_CAAABCBCBBCBACCCBCCCACACBABCABCCBCABBBAABACCBCBACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCAACBAAAAABACABCABBCCCBBBAACCBAABCACBACAACBCABABABA.exe" start= auto displayName= "UserDataSvc_CAAABCBCBBCBACCCBCCCACACBABCABCCBCABBBAABACCBCBACAC"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                PID:6628
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAABCBCBBCBACCCBCCCACACBABCABCCBCABBBAABACCBCBACAC"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:6692
                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                  sc start "UserDataSvc_CAAABCBCBBCBACCCBCCCACACBABCABCCBCABBBAABACCBCBACAC"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                  PID:6772
                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACACAAABCCBBBCBABABBBBBACCBBBCAACAABACABABABCCACAABAC.exe
                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACACAAABCCBBBCBABABBBBBACCBBBCAACAABACABABABCCACAABAC.exe
                                                                                                                                                                                              1⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              PID:5932
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBABBCCBCACAAABBABBCCAACACACBBBACBBABCBABBCCAABACCACBBACACCCCCBBBABACAAAAABCCACCACACCACBCAAAACCABCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCBBBACCACAACCBCCACABABBAACABCCCBAACBCAABABAAAABACA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:6628
                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBABBCCBCACAAABBABBCCAACACACBBBACBBABCBABBCCAABACCACBBACACCCCCBBBABACAAAAABCCACCACACCACBCAAAACCABCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCBBBACCACAACCBCCACABABBAACABCCCBAACBCAABABAAAABACA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                    PID:6624
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABBABBABCBACCBAABCCCACCBABCACCBABCAAABBCACAABCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCBBBACCACAACCBCCACABABBAACABCCCBAACBCAABABAAAABACA.exe" start= auto displayName= "UserDataSvc_ACABBABBABCBACCBAABCCCACCBABCACCBABCAAABBCACAABCBCB"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:4568
                                                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                    sc create "UserDataSvc_ACABBABBABCBACCBAABCCCACCBABCACCBABCAAABBCACAABCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCBBBACCACAACCBCCACABABBAACABCCCBAACBCAABABAAAABACA.exe" start= auto displayName= "UserDataSvc_ACABBABBABCBACCBAABCCCACCBABCACCBABCAAABBCACAABCBCB"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                    PID:5796
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABBABBABCBACCBAABCCCACCBABCACCBABCAAABBCACAABCBCB"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:7040
                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                      sc start "UserDataSvc_ACABBABBABCBACCBAABCCCACCBABCACCBABCAAABBCACAABCBCB"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:6600
                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCAABBCABCCBCBBBCCACCACCCACBCBCBBCCBBCACABCACAACAAB.exe
                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCAABBCABCCBCBBBCCACCACCCACBCBCBBCCBBCACABCACAACAAB.exe
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                    PID:3944
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACCBABCABABACABBCAAACACCACACAABAABCCBBABBBAAABAABCCBBBCAABCACCACCCCABCAACCCAAACBBCCCCACBBABABAACCAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCAAACBCBACCCAAAAABABACCCBABCBAAABBABCCACCBBACBABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:5608
                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACCBABCABABACABBCAAACACCACACAABAABCCBBABBBAAABAABCCBBBCAABCACCACCCCABCAACCCAAACBBCCCCACBBABABAACCAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCAAACBCBACCCAAAAABABACCCBABCBAAABBABCCACCBBACBABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                          PID:7144
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABBBCBACCACAABCCBBABBAACCBBAAABABCCBABABBAACCBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCAAACBCBACCCAAAAABABACCCBABCBAAABBABCCACCBBACBABCC.exe" start= auto displayName= "UserDataSvc_CCABBBCBACCACAABCCBBABBAACCBBAAABABCCBABABBAACCBCCC"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:4152
                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                            sc create "UserDataSvc_CCABBBCBACCACAABCCBBABBAACCBBAAABABCCBABABBAACCBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCAAACBCBACCCAAAAABABACCCBABCBAAABBABCCACCBBACBABCC.exe" start= auto displayName= "UserDataSvc_CCABBBCBACCACAABCCBBABBAACCBBAAABABCCBABABBAACCBCCC"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:7012
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABBBCBACCACAABCCBBABBAACCBBAAABABCCBABABBAACCBCCC"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:2132
                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                              sc start "UserDataSvc_CCABBBCBACCACAABCCBBABBAACCBBAAABABCCBABABBAACCBCCC"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:2292
                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACACAAABCCBBBCBABABBBBBACCBBBCAACAABACABABABCCACAABAC.exe
                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACACAAABCCBBBCBABABBBBBACCBBBCAACAABACABABABCCACAABAC.exe
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          PID:712
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBABAAACBACBACCCCBBCBAABACCACCCAAABABBCACACABAACBABBCBBCAAACBACCCCACCCCACAAABBBBACCACCCBAAABAABBAAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCAAACBCBACCCAAAAABABACCCBABCBAAABBABCCACCBBACBABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:6856
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBABAAACBACBACCCCBBCBAABACCACCCAAABABBCACACABAACBABBCBBCAAACBACCCCACCCCACAAABBBBACCACCCBAAABAABBAAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCAAACBCBACCCAAAAABABACCCBABCBAAABBABCCACCBBACBABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                PID:7064
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABACBCACBBCAACAAACBACCBABBBBCCBBACACCCCBBBAABBBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCAAACBCBACCCAAAAABABACCCBABCBAAABBABCCACCBBACBABCC.exe" start= auto displayName= "UserDataSvc_BABACBCACBBCAACAAACBACCBABBBBCCBBACACCCCBBBAABBBAAC"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:6040
                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                sc create "UserDataSvc_BABACBCACBBCAACAAACBACCBABBBBCCBBACACCCCBBBAABBBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCAAACBCBACCCAAAAABABACCCBABCBAAABBABCCACCBBACBABCC.exe" start= auto displayName= "UserDataSvc_BABACBCACBBCAACAAACBACCBABBBBCCBBACACCCCBBBAABBBAAC"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                PID:3088
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABACBCACBBCAACAAACBACCBABBBBCCBBACACCCCBBBAABBBAAC"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:472
                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                  sc start "UserDataSvc_BABACBCACBBCAACAAACBACCBABBBBCCBBACACCCCBBBAABBBAAC"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:1756
                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACAAABCAAACABAACACAACCBACCCCACBAABBBBCCACCCBAACAAC.exe
                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACAAABCAAACABAACACAACCBACCCCACBAABBBBCCACCCBAACAAC.exe
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                PID:4452
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBABCCBABCACACACABCBAACACBCBBCBAABBBAACAAABBABCBAACBBCBCAACBBBCCBABAACBAAACCABBBBBABCACCACCCBBAAABBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABCAAAABBACBCACBCBABACABBCBBCABCCACCACBCBBABCBCBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:2080
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBABCCBABCACACACABCBAACACBCBBCBAABBBAACAAABBABCBAACBBCBCAACBBBCCBABAACBAAACCABBBBBABCACCACCCBBAAABBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABCAAAABBACBCACBCBABACABBCBBCABCCACCACBCBBABCBCBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                      PID:5292
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBBAAAABBBCACCABBAACBCCACCBBABCBCAACBBABABCBCCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABCAAAABBACBCACBCBABACABBCBBCABCCACCACBCBBABCBCBBBC.exe" start= auto displayName= "UserDataSvc_CBCBBAAAABBBCACCABBAACBCCACCBBABCBCAACBBABABCBCCACB"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:4772
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                        sc create "UserDataSvc_CBCBBAAAABBBCACCABBAACBCCACCBBABCBCAACBBABABCBCCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABCAAAABBACBCACBCBABACABBCBBCABCCACCACBCBBABCBCBBBC.exe" start= auto displayName= "UserDataSvc_CBCBBAAAABBBCACCABBAACBCCACCBBABCBCAACBBABABCBCCACB"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:1296
                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACAAABCAAACABAACACAACCBACCCCACBAABBBBCCACCCBAACAAC.exe
                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACAAABCAAACABAACACAACCBACCCCACBAABBBBCCACCCBAACAAC.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                    PID:1608
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCBABABCCBBABCAACBACCBACACAACCAACBCABBCCCACBABBCBCBACBACCBCBCBCCCABBCAABAACBCAABBCBBAABBCCCCAAABCCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABBAACCACCCACBBBACACBBABCCCBAAACABCBBCBAAABBBCBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:4392
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCBABABCCBBABCAACBACCBACACAACCAACBCABBCCCACBABBCBCBACBACCBCBCBCCCABBCAABAACBCAABBCBBAABBCCCCAAABCCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABBAACCACCCACBBBACACBBABCCCBAAACABCBBCBAAABBBCBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                          PID:6688
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBBAAAABBBCACCABBAACBCCACCBBABCBCAACBBABABCBCCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABBAACCACCCACBBBACACBBABCCCBAAACABCBBCBAAABBBCBACAA.exe" start= auto displayName= "UserDataSvc_CBCBBAAAABBBCACCABBAACBCCACCBBABCBCAACBBABABCBCCACB"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:3316
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                            sc create "UserDataSvc_CBCBBAAAABBBCACCABBAACBCCACCBBABCBCAACBBABABCBCCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABBAACCACCCACBBBACACBBABCCCBAAACABCBBCBAAABBBCBACAA.exe" start= auto displayName= "UserDataSvc_CBCBBAAAABBBCACCABBAACBCCACCBBABCBCAACBBABABCBCCACB"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                            PID:3292
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBBAAAABBBCACCABBAACBCCACCBBABCBCAACBBABABCBCCACB"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:748
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                              sc start "UserDataSvc_CBCBBAAAABBBCACCABBAACBCCACCBBABCBCAACBBABABCBCCACB"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                              PID:2600
                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACAAABCAAACABAACACAACCBACCCCACBAABBBBCCACCCBAACAAC.exe
                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAACAAABCAAACABAACACAACCBACCCCACBAABBBBCCACCCBAACAAC.exe
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          PID:5064
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAACCAABAAACCABAACAACBACBABCAAAABBCCABABBBCBAAAABABCCBAABAABCACABACCBABACCBBBCAABCABAABCCAABAAAACCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABCAABACBACCAABABACBCAACCCBCCBABCBCCBACAACABCBBAACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:6316
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAACCAABAAACCABAACAACBACBABCAAAABBCCABABBBCBAAAABABCCBAABAABCACABACCBABACCBBBCAABCABAABCCAABAAAACCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABCAABACBACCAABABACBCAACCCBCCBABCBCCBACAACABCBBAACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                              PID:6752
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCCABBAACAAABBABBCBACBBCBBAAACCACBCCABBCAACAAAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABCAABACBACCAABABACBCAACCCBCCBABCBCCBACAACABCBBAACCB.exe" start= auto displayName= "UserDataSvc_BBCCCABBAACAAABBABBCBACBBCBBAAACCACBCCABBCAACAAAAAB"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:116
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                              sc create "UserDataSvc_BBCCCABBAACAAABBABBCBACBBCBBAAACCACBCCABBCAACAAAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABCAABACBACCAABABACBCAACCCBCCBABCBCCBACAACABCBBAACCB.exe" start= auto displayName= "UserDataSvc_BBCCCABBAACAAABBABBCBACBBCBBAAACCACBCCABBCAACAAAAAB"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:6440
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCCABBAACAAABBABBCBACBBCBBAAACCACBCCABBCAACAAAAAB"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:6272
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                  sc start "UserDataSvc_BBCCCABBAACAAABBABBCBACBBCBBAAACCACBCCABBCAACAAAAAB"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:6848
                                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCBABBCBBCBABCCCACCABAABACBCBABAACAACCBABBCACBBCABC.exe
                                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCBABBCBBCBABCCCACCABAABACBCBABAACAACCBABBCACBBCABC.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                PID:4512
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCCAACBCBCABBABCBBABCCCACCBAAABCCCACBCCCCCBBCCACCBCCCACCAACACBACBBBBBAACCCCBBABACBAACBCCABBBABCBCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBCBBABCBCABBBBABCBCACACBCACACCAAABBBABBACBBBABCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:1176
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCCAACBCBCABBABCBBABCCCACCBAAABCCCACBCCCCCBBCCACCBCCCACCAACACBACBBBBBAACCCCBBABACBAACBCCABBBABCBCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBCBBABCBCABBBBABCBCACACBCACACCAAABBBABBACBBBABCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                      PID:6184
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCCABCABCBCABBCAABCCCCBBAABABAAAAABBBBBBACCCBBACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBCBBABCBCABBBBABCBCACACBCACACCAAABBBABBACBBBABCABB.exe" start= auto displayName= "UserDataSvc_BCCCABCABCBCABBCAABCCCCBBAABABAAAAABBBBBBACCCBBACAB"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:6324
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                        sc create "UserDataSvc_BCCCABCABCBCABBCAABCCCCBBAABABAAAAABBBBBBACCCBBACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBCBBABCBCABBBBABCBCACACBCACACCAAABBBABBACBBBABCABB.exe" start= auto displayName= "UserDataSvc_BCCCABCABCBCABBCAABCCCCBBAABABAAAAABBBBBBACCCBBACAB"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                        PID:6344
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCCABCABCBCABBCAABCCCCBBAABABAAAAABBBBBBACCCBBACAB"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:4944
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                          sc start "UserDataSvc_BCCCABCABCBCABBCAABCCCCBBAABABAAAAABBBBBBACCCBBACAB"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                          PID:1476
                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCBCCBBCABCBCCAACABAABCCABBACCACABBABBABCCBABAAAAAB.exe
                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCBCCBBCABCBCCAACABAABCCABBACCACABBABBABCCBABAAAAAB.exe
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                      PID:5660
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBAACCACAABBCABBBACABBCACCBBCBAACAACBCBBBABACCCBABCBBBBACCACBCCBBCABBCBABACACBCAACAAAACBCAAABACBBCAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCAACABABABCBABABCBAAABABCAACCACBAACABCCCBCACAABACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:6512
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBAACCACAABBCABBBACABBCACCBBCBAACAACBCBBBABACCCBABCBBBBACCACBCCBBCABBCBABACACBCAACAAAACBCAAABACBBCAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCAACABABABCBABABCBAAABABCAACCACBAACABCCCBCACAABACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                          PID:6616
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBAAACCAABCBABBBCABCBCABACACBBCCBCBBACABCCAACBAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCAACABABABCBABABCBAAABABCAACCACBAACABCCCBCACAABACBB.exe" start= auto displayName= "UserDataSvc_BBBAAACCAABCBABBBCABCBCABACACBBCCBCBBACABCCAACBAABA"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:6560
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                            sc create "UserDataSvc_BBBAAACCAABCBABBBCABCBCABACACBBCCBCBBACABCCAACBAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCAACABABABCBABABCBAAABABCAACCACBAACABCCCBCACAABACBB.exe" start= auto displayName= "UserDataSvc_BBBAAACCAABCBABBBCABCBCABACACBBCCBCBBACABCCAACBAABA"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:6588
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBAAACCAABCBABBBCABCBCABACACBBCCBCBBACABCCAACBAABA"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:4716
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                sc start "UserDataSvc_BBBAAACCAABCBABBBCABCBCABACACBBCCBCBBACABCCAACBAABA"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                PID:6648
                                                                                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABBCBBCCCBBAABCCCBABCBAAABAABCACCCBBCACBBCCACAAACA.exe
                                                                                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABBCBBCCCBBAABCCCBABCBAAABAABCACCCBBCACBBCCACAAACA.exe
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                            PID:6216
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAAACBCCCBACBAAABBCBBBCBBCBBCCBBBBBABBACBACCBBCBCABBAAACABCBABCAACABBCBCAAABACCACACCCCBCBBCCCCBCABCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCBACCCCBABBCCAACBABAAACACBAACBBBABAAABBCBCCACCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:6788
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAAACBCCCBACBAAABBCBBBCBBCBBCCBBBBBABBACBACCBBCBCABBAAACABCBABCAACABBCBCAAABACCACACCCCBCBBCCCCBCABCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCBACCCCBABBCCAACBABAAACACBAACBBBABAAABBCBCCACCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                  PID:6684
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBCBCBBCABBBBBCBABBCCBAAAABBCCBACACAACCCCBABCCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCBACCCCBABBCCAACBABAAACACBAACBBBABAAABBCBCCACCCCBA.exe" start= auto displayName= "UserDataSvc_BACBCBCBBCABBBBBCBABBCCBAAAABBCCBACACAACCCCBABCCCCC"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:6860
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                    sc create "UserDataSvc_BACBCBCBBCABBBBBCBABBCCBAAAABBCCBACACAACCCCBABCCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCBACCCCBABBCCAACBABAAACACBAACBBBABAAABBCBCCACCCCBA.exe" start= auto displayName= "UserDataSvc_BACBCBCBBCABBBBBCBABBCCBAAAABBCCBACACAACCCCBABCCCCC"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                    PID:3064
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBCBCBBCABBBBBCBABBCCBAAAABBCCBACACAACCCCBABCCCCC"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:2160
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                      sc start "UserDataSvc_BACBCBCBBCABBBBBCBABBCCBAAAABBCCBACACAACCCCBABCCCCC"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:5828
                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABCABCACBACCCABBBABAABBCCAABAACCCCBBBABCABBCCACABAC.exe
                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABCABCACBACCCABBBABAABBCCAABAACCCCBBBABCABBCCACABAC.exe
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                  PID:6296
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBCCACCCCBCACACCACABBAAAABCBCCBABBCBCCACCBCABAACCCCAAABACBBAAABCCCCCAAACACBBCBBAACCCAAABBAACCCBCBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCAACCBCBCBAABBABCACACABAAABBAABCAABABCBBBABBCCBBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:7004
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBCCACCCCBCACACCACABBAAAABCBCCBABBCBCCACCBCABAACCCCAAABACBBAAABCCCCCAAACACBBCBBAACCCAAABBAACCCBCBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCAACCBCBCBAABBABCACACABAAABBAABCAABABCBBBABBCCBBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                        PID:7056
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCBCBAABCCCCCCCAAAACBCABBABAABABCACAABCBBBCACBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCAACCBCBCBAABBABCACACABAAABBAABCAABABCBBBABBCCBBBCC.exe" start= auto displayName= "UserDataSvc_CBBCBCBAABCCCCCCCAAAACBCABBABAABABCACAABCBBBCACBACB"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:7084
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                          sc create "UserDataSvc_CBBCBCBAABCCCCCCCAAAACBCABBABAABABCACAABCBBBCACBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCAACCBCBCBAABBABCACACABAAABBAABCAABABCBBBABBCCBBBCC.exe" start= auto displayName= "UserDataSvc_CBBCBCBAABCCCCCCCAAAACBCABBABAABABCACAABCBBBCACBACB"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                          PID:556
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCBCBAABCCCCCCCAAAACBCABBABAABABCACAABCBBBCACBACB"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:2340
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                            sc start "UserDataSvc_CBBCBCBAABCCCCCCCAAAACBCABBABAABABCACAABCBBBCACBACB"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                            PID:4820
                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABCABCACBACCCABBBABAABBCCAABAACCCCBBBABCABBCCACABAC.exe
                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABCABCACBACCCABBBABAABBCCAABAACCCCBBBABCABBCCACABAC.exe
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                        PID:6412
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCBCCCAAACAABBACCBABACBCBAACCCBABCABAACABACACBCCBAAAAABACCBAABCACAAACBBCBACAACBCABACACABACACBCACBAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACABABABACBCBACCBBBCACBBABACCCBBCABCAAACACCCBACBACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:1720
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCBCCCAAACAABBACCBABACBCBAACCCBABCABAACABACACBCCBAAAAABACCBAABCACAAACBBCBACAACBCABACACABACACBCACBAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACABABABACBCBACCBBBCACBBABACCCBBCABCAAACACCCBACBACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                              PID:6320
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAAABAABBBCACCBCABBABCBCAABCBACBCCCBAAACACBAABAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACABABABACBCBACCBBBCACBBABACCCBBCABCAAACACCCBACBACCB.exe" start= auto displayName= "UserDataSvc_ABAAABAABBBCACCBCABBABCBCAABCBACBCCCBAAACACBAABAACB"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:3980
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                sc create "UserDataSvc_ABAAABAABBBCACCBCABBABCBCAABCBACBCCCBAAACACBAABAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACABABABACBCBACCBBBCACBBABACCCBBCABCAAACACCCBACBACCB.exe" start= auto displayName= "UserDataSvc_ABAAABAABBBCACCBCABBABCBCAABCBACBCCCBAAACACBAABAACB"
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                PID:4528
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAAABAABBBCACCBCABBABCBCAABCBACBCCCBAAACACBAABAACB"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:6536
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                  sc start "UserDataSvc_ABAAABAABBBCACCBCABBABCBCAABCBACBCCCBAAACACBAABAACB"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                                                  PID:2328
                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCAACBAAAAABACABCABBCCCBBBAACCBAABCACBACAACBCABABABA.exe
                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCAACBAAAAABACABCABBCCCBBBAACCBAABCACBACAACBCABABABA.exe
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                              PID:6796
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACBCBAACCBCBBBACBBCCBACAACBAAABBBBBCBBCBCABABBCAAAACCCCBBBCCCBBACBCCCABCCABAAACBACCCBAABACBACABACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAABAABAACAACBCBBCBBBCBCBBBBBCBCABACBBCCBBCBBAAABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:5352
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACBCBAACCBCBBBACBBCCBACAACBAAABBBBBCBBCBCABABBCAAAACCCCBBBCCCBBACBCCCABCCABAAACBACCCBAABACBACABACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAABAABAACAACBCBBCBBBCBCBBBBBCBCABACBBCCBBCBBAAABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                    PID:6252
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCBBABACCCAACBCCCBCBCACABAACBCBBCBACBACBCCBABBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAABAABAACAACBCBBCBBBCBCBBBBBCBCABACBBCCBBCBBAAABCBC.exe" start= auto displayName= "UserDataSvc_BBBCBBABACCCAACBCCCBCBCACABAACBCBBCBACBACBCCBABBCCA"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:6832
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                      sc create "UserDataSvc_BBBCBBABACCCAACBCCCBCBCACABAACBCBBCBACBACBCCBABBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAABAABAACAACBCBBCBBBCBCBBBBBCBCABACBBCCBBCBBAAABCBC.exe" start= auto displayName= "UserDataSvc_BBBCBBABACCCAACBCCCBCBCACABAACBCBBCBACBACBCCBABBCCA"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:3064
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCBBABACCCAACBCCCBCBCACABAACBCBBCBACBACBCCBABBCCA"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:3268
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                        sc start "UserDataSvc_BBBCBBABACCCAACBCCCBCBCACABAACBCBBCBACBACBCCBABBCCA"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:5768
                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBBABAACCCCABABAABABBAAACAABBBCCBACBBCABBCABBABBCACA.exe
                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBBABAACCCCABABAABABBAAACAABBBCCBACBBCABBCABBABBCACA.exe
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                    PID:6936
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACAABABBABCCAAACBCACABAABCCBACAAACCABBBBABBBCACBACBCBBABCCACBABBBBCAAACAAABABCACBCACCACCBBAABCCABCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCABBABBBBCAABCCBBBBCCABACCCCCCAABCCACBCAAABAACABCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:6544
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACAABABBABCCAAACBCACABAABCCBACAAACCABBBBABBBCACBACBCBBABCCACBABBBBCAAACAAABABCACBCACCACCBBAABCCABCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCABBABBBBCAABCCBBBBCCABACCCCCCAABCCACBCAAABAACABCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                          PID:3064
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBCAABABABBABBCACAAAACCCCACCABCCBCCABCCAACACACAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCABBABBBBCAABCCBBBBCCABACCCCCCAABCCACBCAAABAACABCAAA.exe" start= auto displayName= "UserDataSvc_CABBCAABABABBABBCACAAAACCCCACCABCCBCCABCCAACACACAAB"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:880
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                            sc create "UserDataSvc_CABBCAABABABBABBCACAAAACCCCACCABCCBCCABCCAACACACAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCABBABBBBCAABCCBBBBCCABACCCCCCAABCCACBCAAABAACABCAAA.exe" start= auto displayName= "UserDataSvc_CABBCAABABABBABBCACAAAACCCCACCABCCBCCABCCAACACACAAB"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:6708
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBCAABABABBABBCACAAAACCCCACCABCCBCCABCCAACACACAAB"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:3120
                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:6752
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                  sc start "UserDataSvc_CABBCAABABABBABBCACAAAACCCCACCABCCBCCABCCAACACACAAB"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                                                                  PID:3900
                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBCBBABCBCABBBBABCBCACACBCACACCAAABBBABBACBBBABCABB.exe
                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBCBBABCBCABBBBABCBCACACBCACACCAAABBBABBACBBBABCABB.exe
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                              PID:5624
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABAAACCCABBBCACBBBACAACCAACBCCCCCAABBCCBBBBCABBAAAAABABAACCBCCCBCAABCCAAACABCCAACCCABBCBABCCCACBCACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBCCBABABCBAAACBACAAACABAACCACCACCCBACABCACBABCACCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:7704
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABAAACCCABBBCACBBBACAACCAACBCCCCCAABBCCBBBBCABBAAAAABABAACCBCCCBCAABCCAAACABCCAACCCABBCBABCCCACBCACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBCCBABABCBAAACBACAAACABAACCACCACCCBACABCACBABCACCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                    PID:7788
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACCBCCCCCBBABCCBCCBCCCBBCBABBCABCABBCABCBBBBCCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBCCBABABCBAAACBACAAACABAACCACCACCCBACABCACBABCACCAA.exe" start= auto displayName= "UserDataSvc_CCACCBCCCCCBBABCCBCCBCCCBBCBABBCABCABBCABCBBBBCCCAB"
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:7764
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                      sc create "UserDataSvc_CCACCBCCCCCBBABCCBCCBCCCBBCBABBCABCABBCABCBBBBCCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBCCBABABCBAAACBACAAACABAACCACCACCCBACABCACBABCACCAA.exe" start= auto displayName= "UserDataSvc_CCACCBCCCCCBBABCCBCCBCCCBBCBABBCABCABBCABCBBBBCCCAB"
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:3916
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACCBCCCCCBBABCCBCCBCCCBBCBABBCABCABBCABCBBBBCCCAB"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:3948
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                        sc start "UserDataSvc_CCACCBCCCCCBBABCCBCCBCCCBBCBABBCABCABBCABCBBBBCCCAB"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                                        PID:7980
                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCAACABABABCBABABCBAAABABCAACCACBAACABCCCBCACAABACBB.exe
                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCAACABABABCBABABCBAAABABCAACCACBAACABCCCBCACAABACBB.exe
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                    PID:6584
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABBBAACABABCBABACBABABCBACCCACBCBCAAABBCCACAAAABBAABCCBACABBAAABBABCCBBBCBBCBCAACACBBAABCAACACAACCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCACCACAACABCCACCCCBAABCCAABBABACCBCCBBCCBACABABCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:7364
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABBBAACABABCBABACBABABCBACCCACBCBCAAABBCCACAAAABBAABCCBACABBAAABBABCCBBBCBBCBCAACACBBAABCAACACAACCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCACCACAACABCCACCCCBAABCCAABBABACCBCCBBCCBACABABCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                        PID:7416
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBABCABCBCABCCCACACAACABCBAAAABCCCAAABCACCBCACBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCACCACAACABCCACCCCBAABCCAABBABACCBCCBBCCBACABABCCBA.exe" start= auto displayName= "UserDataSvc_BBBABCABCBCABCCCACACAACABCBAAAABCCCAAABCACCBCACBBCA"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:7436
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                          sc create "UserDataSvc_BBBABCABCBCABCCCACACAACABCBAAAABCCCAAABCACCBCACBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCACCACAACABCCACCCCBAABCCAABBABACCBCCBBCCBACABABCCBA.exe" start= auto displayName= "UserDataSvc_BBBABCABCBCABCCCACACAACABCBAAAABCCCAAABCACCBCACBBCA"
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                          PID:7484
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBABCABCBCABCCCACACAACABCBAAAABCCCAAABCACCBCACBBCA"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:7536
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                            sc start "UserDataSvc_BBBABCABCBCABCCCACACAACABCBAAAABCCCAAABCACCBCACBBCA"
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:7592
                                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCBACCCCBABBCCAACBABAAACACBAACBBBABAAABBCBCCACCCCBA.exe
                                                                                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCBACCCCBABBCCAACBABAAACACBAACBBBABAAABBCBCCACCCCBA.exe
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                          PID:2716
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBCBCCBCABBBBBCBBCACBBBAAABCABBBCABBACCAACABBBABAAACABBBAABBABABABABACBCAABCBABABBBCAAAAACBCCCBCCBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBCBACCBCAACACBACABAAACACBACBCAAACABBBABBBBABCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:6820
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBCBCCBCABBBBBCBBCACBBBAAABCABBBCABBACCAACABBBABAAACABBBAABBABABABABACBCAABCBABABBBCAAAAACBCCCBCCBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBCBACCBCAACACBACABAAACACBACBCAAACABBBABBBBABCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                PID:1296
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBBABCBABCABBABBABBCACAABCCBCCCABACAABBBBAAACAAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBCBACCBCAACACBACABAAACACBACBCAAACABBBABBBBABCCBA.exe" start= auto displayName= "UserDataSvc_CBBBABCBABCABBABBABBCACAABCCBCCCABACAABBBBAAACAAACA"
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:7056
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                  sc create "UserDataSvc_CBBBABCBABCABBABBABBCACAABCCBCCCABACAABBBBAAACAAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBCBACCBCAACACBACABAAACACBACBCAAACABBBABBBBABCCBA.exe" start= auto displayName= "UserDataSvc_CBBBABCBABCABBABBABBCACAABCCBCCCABACAABBBBAAACAAACA"
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:4456
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBBABCBABCABBABBABBCACAABCCBCCCABACAABBBBAAACAAACA"
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:6496
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:6252
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                        sc start "UserDataSvc_CBBBABCBABCABBABBABBCACAABCCBCCCABACAABBBBAAACAAACA"
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                                                        PID:5952
                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCAACCBCBCBAABBABCACACABAAABBAABCAABABCBBBABBCCBBBCC.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCAACCBCBCBAABBABCACACABAAABBAABCAABABCBBBABBCCBBBCC.exe
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                    PID:3196
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAACCAABBCBCCCCACBCAABCBACAACABBCAACABCCACBBCACAAACBABCACAAACBABAACAACBBCCABABAABBCBABBBACABBBBACACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBBBCCACACCABBABAABCACCCCBBABCACCCABCCBABABCAAACCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:7680
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAACCAABBCBCCCCACBCAABCBACAACABBCAACABCCACBBCACAAACBABCACAAACBABAACAACBBCCABABAABBCBABBBACABBBBACACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBBBCCACACCABBABAABCACCCCBBABCACCCABCCBABABCAAACCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                        PID:7724
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACACACBAAACBABBCACCCABAACACBACBCCCBCCBCBCCBCABAACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBBBCCACACCABBABAABCACCCCBBABCACCCABCCBABABCAAACCBBC.exe" start= auto displayName= "UserDataSvc_ACACACBAAACBABBCACCCABAACACBACBCCCBCCBCBCCBCABAACCA"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:7744
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                          sc create "UserDataSvc_ACACACBAAACBABBCACCCABAACACBACBCCCBCCBCBCCBCABAACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBBBCCACACCABBABAABCACCCCBBABCACCCABCCBABABCAAACCBBC.exe" start= auto displayName= "UserDataSvc_ACACACBAAACBABBCACCCABAACACBACBCCCBCCBCBCCBCABAACCA"
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                          PID:7788
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACACACBAAACBABBCACCCABAACACBACBCCCBCCBCBCCBCABAACCA"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:7816
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                            sc start "UserDataSvc_ACACACBAAACBABBCACCCABAACACBACBCCCBCCBCBCCBCABAACCA"
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:7864
                                                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACABABABACBCBACCBBBCACBBABACCCBBCABCAAACACCCBACBACCB.exe
                                                                                                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACABABABACBCBACCBBBCACBBABACCCBBCABCAAACACCCBACBACCB.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          PID:6608
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBAABAACABABCCABCCCBCCAAACBBBCBCAACCBAACCBBAAABABCCABAABCCCBBAACCBBAABCCCAACCACBBAACABCCBABBBACBBACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBAACBCCAAACBCACCAABCBBCBAABCBACBBCCCCBCAAAABBACBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:7344
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBAABAACABABCCABCCCBCCAAACBBBCBCAACCBAACCBBAAABABCCABAABCCCBBAACCBBAABCCCAACCACBBAACABCCBABBBACBBACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBAACBCCAAACBCACCAABCBBCBAABCBACBBCCCCBCAAAABBACBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                PID:7416
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCBCCCAACABACACCABACACACAABBCCCCBBCCCBABBAACBBCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBAACBCCAAACBCACCAABCBBCBAABCBACBBCCCCBCAAAABBACBCBC.exe" start= auto displayName= "UserDataSvc_CCCBCCCAACABACACCABACACACAABBCCCCBBCCCBABBAACBBCCAA"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:7396
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                  sc create "UserDataSvc_CCCBCCCAACABACACCABACACACAABBCCCCBBCCCBABBAACBBCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBAACBCCAAACBCACCAABCBBCBAABCBACBBCCCCBCAAAABBACBCBC.exe" start= auto displayName= "UserDataSvc_CCCBCCCAACABACACCABACACACAABBCCCCBBCCCBABBAACBBCCAA"
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                                                                                                  PID:7488
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCBCCCAACABACACCABACACACAABBCCCCBBCCCBABBAACBBCCAA"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:7520
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                    sc start "UserDataSvc_CCCBCCCAACABACACCABACACACAABBCCCCBBCCCBABBAACBBCCAA"
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:7648
                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCBBBACCACAACCBCCACABABBAACABCCCBAACBCAABABAAAABACA.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCBBBACCACAACCBCCACABABBAACABCCCBAACBCAABABAAAABACA.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  PID:5524
                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCAAACBCBACCCAAAAABABACCCBABCBAAABBABCCACCBBACBABCC.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCAAACBCBACCCAAAAABABACCCBABCBAAABBABCCACCBBACBABCC.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:6024
                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCAAACBCBACCCAAAAABABACCCBABCBAAABBABCCACCBBACBABCC.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCAAACBCBACCCAAAAABABACCCBABCBAAABBABCCACCBBACBABCC.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  PID:7000
                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCAAACBCBACCCAAAAABABACCCBABCBAAABBABCCACCBBACBABCC.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCAAACBCBACCCAAAAABABACCCBABCBAAABBABCCACCBBACBABCC.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  PID:3088
                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABCAABACBACCAABABACBCAACCCBCCBABCBCCBACAACABCBBAACCB.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABCAABACBACCAABABACBCAACCCBCCBABCBCCBACAACABCBBAACCB.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  PID:6732
                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABCAAAABBACBCACBCBABACABBCBBCABCCACCACBCBBABCBCBBBC.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABCAAAABBACBCACBCBABACABBCBBCABCCACCACBCBBABCBCBBBC.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  PID:5452
                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABBAACCACCCACBBBACACBBABCCCBAAACABCBBCBAAABBBCBACAA.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABBAACCACCCACBBBACACBBABCCCBAAACABCBBCBAAABBBCBACAA.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  PID:1672
                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBCBACCBCAACACBACABAAACACBACBCAAACABBBABBBBABCCBA.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBCBACCBCAACACBACABAAACACBACBCAAACABBBABBBBABCCBA.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  PID:1904
                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAABAABAACAACBCBBCBBBCBCBBBBBCBCABACBBCCBBCBBAAABCBC.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAABAABAACAACBCBBCBBBCBCBBBBBCBCABACBBCCBBCBBAAABCBC.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  PID:1520
                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABCAABACBACCAABABACBCAACCCBCCBABCBCCBACAACABCBBAACCB.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABCAABACBACCAABABACBCAACCCBCCBABCBCCBACAACABCBBAACCB.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  PID:3128
                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBCBACCBCAACACBACABAAACACBACBCAAACABBBABBBBABCCBA.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBCBACCBCAACACBACABAAACACBACBCAAACABBBABBBBABCCBA.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  PID:3424
                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAABAABAACAACBCBBCBBBCBCBBBBBCBCABACBBCCBBCBBAAABCBC.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAABAABAACAACBCBBCBBBCBCBBBBBCBCABACBBCCBBCBBAAABCBC.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  PID:4080
                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCABBABBBBCAABCCBBBBCCABACCCCCCAABCCACBCAAABAACABCAAA.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCABBABBBBCAABCCBBBBCCABACCCCCCAABCCACBCAAABAACABCAAA.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                  PID:6596
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCAAABBCAAAABBCCBAACAACCCAABCACCCBBCBBAACCBBBAABCCCCABBBCBABBBCABBBABABCBBACBBBACBCBBABACCCBAABBCBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBBACCABCBAABABBCBBCAAACACAACCBBABCBBCAAACBCCCABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:7992
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCAAABBCAAAABBCCBAACAACCCAABCACCCBBCBBAACCBBBAABCCCCABBBCBABBBCABBBABABCBBACBBBACBCBBABACCCBAABBCBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBBACCABCBAABABBCBBCAAACACAACCBBABCBBCAAACBCCCABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                        PID:8048
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCCBACAAABAABAABCABCBACBACBAACCABCCBCBCBCAABBBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBBACCABCBAABABBCBBCAAACACAACCBBABCBBCAAACBCCCABCA.exe" start= auto displayName= "UserDataSvc_CCBCCBACAAABAABAABCABCBACBACBAACCABCCBCBCBCAABBBBAB"
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:8140
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                        sc create "UserDataSvc_CCBCCBACAAABAABAABCABCBACBACBAACCABCCBCBCBCAABBBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBBACCABCBAABABBCBBCAAACACAACCBBABCBBCAAACBCCCABCA.exe" start= auto displayName= "UserDataSvc_CCBCCBACAAABAABAABCABCBACBACBAACCABCCBCBCBCAABBBBAB"
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                                                                        PID:1332
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCCBACAAABAABAABCABCBACBACBAACCABCCBCBCBCAABBBBAB"
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:640
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                          sc start "UserDataSvc_CCBCCBACAAABAABAABCABCBACBACBAACCABCCBCBCBCAABBBBAB"
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:7252
                                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCACCACAACABCCACCCCBAABCCAABBABACCBCCBBCCBACABABCCBA.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCACCACAACABCCACCCCBAABCCAABBABACCBCCBBCCBACABABCCBA.exe
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                        PID:7612
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBACCBCAAAABBCCBBBAAAAACACBCCCCBBBCBACBCABABBCCCCCAAABBBBCAAACABCABCBAAABACCBCCCBBBBBCABBABBBCCCAAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCABCBCAABAABCAACBBBABBBACBABCCBBACBAAABBBCABABCCACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:884
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBACCBCAAAABBCCBBBAAAAACACBCCCCBBBCBACBCABABBCCCCCAAABBBBCAAACABCABCBAAABACCBCCCBBBBBCABBABBBCCCAAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCABCBCAABAABCAACBBBABBBACBABCCBBACBAAABBBCABABCCACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                              PID:8116
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBBABCBACCCBAACABCCBBCABAAACCAACBBBBCCBBBBBBACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCABCBCAABAABCAACBBBABBBACBABCCBBACBAAABBBCABABCCACCA.exe" start= auto displayName= "UserDataSvc_ABBBBABCBACCCBAACABCCBBCABAAACCAACBBBBCCBBBBBBACBCA"
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:8060
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                              sc create "UserDataSvc_ABBBBABCBACCCBAACABCCBBCABAAACCAACBBBBCCBBBBBBACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCABCBCAABAABCAACBBBABBBACBABCCBBACBAAABBBCABABCCACCA.exe" start= auto displayName= "UserDataSvc_ABBBBABCBACCCBAACABCCBBCABAAACCAACBBBBCCBBBBBBACBCA"
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                                                                                                                              PID:8028
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBBABCBACCCBAACABCCBBCABAAACCAACBBBBCCBBBBBBACBCA"
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:8160
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                sc start "UserDataSvc_ABBBBABCBACCCBAACABCCBBCABAAACCAACBBBBCCBBBBBBACBCA"
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:3796
                                                                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBBBCCACACCABBABAABCACCCCBBABCACCCABCCBABABCAAACCBBC.exe
                                                                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBBBCCACACCABBABAABCACCCCBBABCACCCABCCBABABCAAACCBBC.exe
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:7876
                                                                                                                                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBBACCABCBAABABBCBBCAAACACAACCBBABCBBCAAACBCCCABCA.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBBACCABCBAABABBCBBCAAACACAACCBBABCBBCAAACBCCCABCA.exe
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:7264
                                                                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBAACBCCAAACBCACCAABCBBCBAABCBACBBCCCCBCAAAABBACBCBC.exe
                                                                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBAACBCCAAACBCACCAABCBBCBAABCBACBBCCCCBCAAAABBACBCBC.exe
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:7660
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBCCBABABCBAAACBACAAACABAACCACCACCCBACABCACBABCACCAA.exe
                                                                                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBCCBABABCBAAACBACAAACABAACCACCACCCBACABCACBABCACCAA.exe
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:8004
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBCCBABABCBAAACBACAAACABAACCACCACCCBACABCACBABCACCAA.exe
                                                                                                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBCCBABABCBAAACBACAAACABAACCACCACCCBACABCACBABCACCAA.exe
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:4404
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCABCBCAABAABCAACBBBABBBACBABCCBBACBAAABBBCABABCCACCA.exe
                                                                                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCABCBCAABAABCAACBBBABBBACBABCCBBACBAAABBBCABABCCACCA.exe
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:4372

                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                              Reconnaissance

                                                                                                                                                                                                                                                                                                                                              Resource Development

                                                                                                                                                                                                                                                                                                                                              Initial Access

                                                                                                                                                                                                                                                                                                                                              Execution

                                                                                                                                                                                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1053

                                                                                                                                                                                                                                                                                                                                              Scheduled Task

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1053.005

                                                                                                                                                                                                                                                                                                                                              System Services

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1569

                                                                                                                                                                                                                                                                                                                                              Service Execution

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1569.002

                                                                                                                                                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1543

                                                                                                                                                                                                                                                                                                                                              Windows Service

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1543.003

                                                                                                                                                                                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1053

                                                                                                                                                                                                                                                                                                                                              Scheduled Task

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1053.005

                                                                                                                                                                                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1543

                                                                                                                                                                                                                                                                                                                                              Windows Service

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1543.003

                                                                                                                                                                                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1053

                                                                                                                                                                                                                                                                                                                                              Scheduled Task

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1053.005

                                                                                                                                                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                                                                                                                                                              Modify Registry

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1112

                                                                                                                                                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                                                                                                                                                              System Location Discovery

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1614

                                                                                                                                                                                                                                                                                                                                              System Language Discovery

                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                              T1614.001

                                                                                                                                                                                                                                                                                                                                              Lateral Movement

                                                                                                                                                                                                                                                                                                                                              Collection

                                                                                                                                                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                                                                                                                                                              Exfiltration

                                                                                                                                                                                                                                                                                                                                              Impact

                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                              qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                              • Path C:\PerfLogs\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                              • Size 10B
                                                                                                                                                                                                                                                                                                                                              • SHA256 2adf65731e32902d4b8f3bb3e0b4e9611328bd30e21e3f60b3055ad71ebe9066
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                              • Path C:\PerfLogs\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                              • Size 10B
                                                                                                                                                                                                                                                                                                                                              • SHA256 c20c2fc6b947d665422fc7ff83135507aa96813f7480092fe79786862cf83e03
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                              • Size 10B
                                                                                                                                                                                                                                                                                                                                              • SHA256 553aae4d9d98fea2e35267dc33e22d3855c887a141753dfe6a8245a5606a2c6d
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 9320ed84f9c65fe169559da3592efd152353edef8d997c395934eaf30af05f10
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                              • Size 10B
                                                                                                                                                                                                                                                                                                                                              • SHA256 7f4a27a0cb396c1bf3b5fae028f663e77f5e2ddf6cff226239b19d55725faba6
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                              • Size 10B
                                                                                                                                                                                                                                                                                                                                              • SHA256 f788d05d775126cc651c8c232668f90881253feae3238051a2b9482668136d6e
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                              • Size 10B
                                                                                                                                                                                                                                                                                                                                              • SHA256 6a02efcd58272d27f53bb447367174a41987fa3b6d9a049533bdd7f5089d035e
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                              • Size 10B
                                                                                                                                                                                                                                                                                                                                              • SHA256 4971c594892d32bec7c29ea51add0e224f804e75220e931044d2c3ef03015d43
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                                                                              • Size 10B
                                                                                                                                                                                                                                                                                                                                              • SHA256 ea392a722f77a7b1cd5d03ea69f349554e323619f1c9014bcc7d1249f25d279c
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              svchost_CBABBCBBBAABBCCBCACBACACCAACBAAACABCBBAACCBCABCCBBCACAC.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBCBBBAABBCCBCACBACACCAACBAAACABCBBAACCBCABCCBBCACAC.exe
                                                                                                                                                                                                                                                                                                                                              • Size 18.7MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 dd6134dd4af1cd4e040a8382f00cadee01fe3368ca3ad5d3b96bbe342f744d8a
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 5KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 02e20c477bdb2079c16ef834fcc71bb258b1fe10661a0df25fb9b26fb355482c
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 6KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 2c78793d8feaccf946ded52c8c2292d0e496137bf1305052b492102b72981a8e
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 2e3ff7eef7568a6066105d0dc3145274df6084196f195781f06ad7ea41b90737
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 9KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 fb512ba083714ce3515ea6de24e8113c5593c51f0c396126e62ac4eb094e0128
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 9d4cf446170de1b2a654e368dc133577143fadd91f74eb1f5e66b44aaea3a9aa
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 35c24a5d0181e8dec38a7e949039910d0c9efc3ece8b41410d284ede33fab473
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 13KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 b184b14e6e88bd7985a68b0f8eb58b831ca7cf15b5fe7353f34ca45a71779954
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 13KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 14676c37ef76ea2606e38e32856e88c56450f407c19ac25645222155bb2677d9
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 15KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 2fa54653b98a7e19db46c8d83d2552dac691bf2feb18fee76f6dbb622119f195
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 15KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 a8cee025e08758e72bd15dfcafcd7053d5ba46f8986375edbf30ffcf5e28d38b
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 ce9112a9809ed0483ef6302ecec0eb9d43fcfdb62911969dffb24a08d8a54235
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 03592c9241813e13ae6c0e71fd14872af42b80b0c565a6d394889eaf234c0873
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 dc5e5ae47f0dbb5bc8641df052d8baf9ce0842019eb332cb6d2488a8e9e3e016
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 17KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 d8b0658d82d367eecd991d4e75850c138213b56650969b7a206b52c39b6fc80f
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 17KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 f2f56c05e6e794b15ab90fba04b57b57e76b735a1ed462f2e129cec03454cb25
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 17KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 ef1001d54c65ebefb0b84596b93fd2cb1112fb0e7c26e202453706f937be0065
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 5a4d260a795f1587c5a56f087c5e2f8a328d8f07ddec0355516db05573559fb7
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 356f00202e19ab32801efb84b6e4dcbbeb444ab4fe09d912ff72f661acc454a7
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 80a9984a17c5f6d6900c034df7c27cb9a75e5b2e68edc3a5885cd8a9be5edaff
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 9c8cc36a1f0ed472268d2845ca49c47c84e1afdebee28607522bf90c585ed00c
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 f259dd206cc6e276b55520e2a37c2b1c95376f031f1b49e38b5d2fba5d9a8c80
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 168619656b4b44633b11f042d82e2ff979db77cc863b205e01c06fb23574d614
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 b43be86abfb16dfa2852c1300fef9d0686f8c52613b7859bb793cda259d737d4
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                                                                              • Size 5KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 9753e3a4d490334e0278250ac61ff4c4c3289efd30205edabdd71ebddb58774f
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              memory/212-502-0x00000000007F0000-0x0000000000812000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/216-503-0x00000000007F0000-0x0000000000812000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/712-826-0x00000000001C0000-0x00000000001E2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/764-489-0x0000000000980000-0x00000000009A2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/764-625-0x0000000000980000-0x00000000009A2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/828-841-0x0000000000170000-0x0000000000192000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/828-724-0x0000000000170000-0x0000000000192000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1056-205-0x00000000002F0000-0x0000000000312000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1056-283-0x00000000002F0000-0x0000000000312000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1252-287-0x0000000000820000-0x0000000000842000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1252-479-0x0000000000820000-0x0000000000842000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1352-668-0x0000000000CE0000-0x0000000000D02000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1352-804-0x0000000000CE0000-0x0000000000D02000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1464-545-0x0000000000600000-0x0000000000622000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1464-792-0x0000000000600000-0x0000000000622000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1608-829-0x0000000000560000-0x0000000000582000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1820-791-0x00000000002E0000-0x0000000000302000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/1820-544-0x00000000002E0000-0x0000000000302000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/2356-106-0x0000000000200000-0x0000000000222000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/2356-54-0x0000000000200000-0x0000000000222000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/2452-244-0x00000000003E0000-0x0000000000402000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/2588-102-0x0000000000140000-0x0000000000162000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/2776-417-0x0000000000BC0000-0x0000000000BE2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/2872-490-0x0000000000D90000-0x0000000000DB2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/2872-288-0x0000000000D90000-0x0000000000DB2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/3240-690-0x00000000003E0000-0x0000000000402000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/3240-493-0x00000000003E0000-0x0000000000402000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/3296-460-0x00000000002F0000-0x0000000000312000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/3296-355-0x00000000002F0000-0x0000000000312000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/3552-3-0x0000000000650000-0x0000000000672000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/3776-284-0x0000000000D60000-0x0000000000D82000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/3776-156-0x0000000000D60000-0x0000000000D82000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/3880-222-0x00000000009B0000-0x00000000009D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/3880-381-0x00000000009B0000-0x00000000009D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/3944-825-0x0000000000DF0000-0x0000000000E12000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4332-823-0x0000000000CE0000-0x0000000000D02000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4332-670-0x0000000000CE0000-0x0000000000D02000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4364-202-0x0000000000140000-0x0000000000162000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4364-107-0x0000000000140000-0x0000000000162000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4452-827-0x0000000000560000-0x0000000000582000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4572-495-0x0000000000C90000-0x0000000000CB2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4744-710-0x0000000000550000-0x0000000000572000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4744-805-0x0000000000550000-0x0000000000572000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4784-45-0x0000000000200000-0x0000000000222000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4860-223-0x00000000009B0000-0x00000000009D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/4860-356-0x00000000009B0000-0x00000000009D2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5044-759-0x0000000000E20000-0x0000000000E42000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5064-830-0x0000000000560000-0x0000000000582000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5092-31-0x0000000000DE0000-0x0000000000E02000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5092-85-0x0000000000DE0000-0x0000000000E02000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5180-707-0x00000000003E0000-0x0000000000402000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5180-492-0x00000000003E0000-0x0000000000402000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5244-28-0x0000000000DE0000-0x0000000000E02000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5264-822-0x0000000000550000-0x0000000000572000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5264-546-0x0000000000550000-0x0000000000572000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5428-418-0x0000000000BC0000-0x0000000000BE2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5544-164-0x00000000006C0000-0x00000000006E2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5544-243-0x00000000006C0000-0x00000000006E2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5620-509-0x0000000000590000-0x00000000005B2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5620-577-0x0000000000590000-0x00000000005B2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5896-203-0x0000000000C30000-0x0000000000C52000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5896-108-0x0000000000C30000-0x0000000000C52000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/5932-824-0x00000000001C0000-0x00000000001E2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/6136-416-0x0000000000360000-0x0000000000382000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download