dd6134dd4af1cd4e040a8382f00cadee01fe3368ca3ad5d3b96bbe342f744d8a

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_4a194671a0c90767e5b839a8c83585b3_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
Size 18.7MB
Sample260716-ac7cssgw7p
SHA256 dd6134dd4af1cd4e040a8382f00cadee01fe3368ca3ad5d3b96bbe342f744d8a
MD5 4a194671a0c90767e5b839a8c83585b3
SHA1 798b573e94237aa5c3509d6562ca5a0428002fff
SHA512 77990314e0b427e9de45f457ae31dd90332430af071b7ae7eec12e4aaaddbfc735cc8d9e680a584d45aec50d8c8217acd7e8d6378cb95075198ef1f6f278b3a0
SSDEEP 98304:B4TQzzJoDfuBcMv+A73XAZ/IJsiC5sop7cTg:BLzD+F2siC592Tg
TLSH
T182177D11FBEA80F5F56351308977D27BE735B8064A31DB9B8640DA1F6F33A904D2A326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c48b-11.dat	INDICATOR_EXE_Packed_Fody

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	2026-07-15_4a194671a0c90767e5b839a8c83585b3_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_CBBACCAAABBABBCCCCBBACABACCABCBCABCCBCBAABCACBABBCBCBBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe

Executes dropped EXE 51 IoCs

pid	Process
2484	svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe
4500	svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe
3036	svchost_CBBACCAAABBABBCCCCBBACABACCABCBCABCCBCBAABCACBABBCBCBBC.exe
5608	svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe
6096	svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe
5596	svchost_ABABBCBCCCABAACCBBABAACCBAABAABBCAACBBBAACBCBACAAAABCCB.exe
1664	svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe
5900	svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe
5180	svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe
4616	svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe
3180	svchost_BCACBBABBBBCCCCABBBCCBABBCBABCBBBCBCCACCABBBACCAAAACBBB.exe
3488	svchost_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCB.exe
3464	svchost_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCB.exe
4456	svchost_AACCCAABCCBCAACBCCBBACCBCCCBCBBCCCBBBAAAACABBBABCCBCBCA.exe
5500	svchost_AACCCAABCCBCAACBCCBBACCBCCCBCBBCCCBBBAAAACABBBABCCBCBCA.exe
4988	svchost_ACACCCCAAACABAAACACBBCBACBCBCBBACACAACAAAAAACABBBABAACB.exe
5504	svchost_ACACCCCAAACABAAACACBBCBACBCBCBBACACAACAAAAAACABBBABAACB.exe
848	svchost_BCCCAAACABACCABABBCAABCABABBAABBAACCABBAACAABCACACCBCBB.exe
4748	svchost_BCCCAAACABACCABABBCAABCABABBAABBAACCABBAACAABCACACCBCBB.exe
5336	svchost_ACBABACBACABCAABACBCACABCCBBBCBBBBBCBCCBBCCACCAACBCABAA.exe
4532	svchost_ACBABACBACABCAABACBCACABCCBBBCBBBBBCBCCBBCCACCAACBCABAA.exe
1556	svchost_CBAABCAACBBCCABCCCCACCBAABABACBCBABCACBBBCACABAAACCBACA.exe
3832	svchost_CBAABCAACBBCCABCCCCACCBAABABACBCBABCACBBBCACABAAACCBACA.exe
4848	svchost_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCA.exe
3636	svchost_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCA.exe
2804	svchost_CACACAABCABBABCAAACACBABBBBABBCCBCCACBBBBABABBABACABBAA.exe
5724	svchost_CCAAABBBCCBBBBABABCCABCABAAACBAAAAAAACCCBBCBCAAABBBCCAC.exe
2624	svchost_ABAACABCAAAABBCACBCCABABAACAACBABCCACAAACBCBCBBBBCABBCA.exe
6212	svchost_CCAAABBBCCBBBBABABCCABCABAAACBAAAAAAACCCBBCBCAAABBBCCAC.exe
6608	svchost_CACACAABCABBABCAAACACBABBBBABBCCBCCACBBBBABABBABACABBAA.exe
6724	svchost_ABAACABCAAAABBCACBCCABABAACAACBABCCACAAACBCBCBBBBCABBCA.exe
6852	svchost_BABBBCABAABBBBAACCCCABCAABBBCBCBBBACBAACBBABCCCCCBBBAAA.exe
6872	svchost_BABBBCABAABBBBAACCCCABCAABBBCBCBBBACBAACBBABCCCCCBBBAAA.exe
6900	svchost_ABCCBBABBCABBCBCCCACBCBAAAAABBCCBCCAABABBAAACCBCAAABACA.exe
7128	svchost_ABCCBBABBCABBCBCCCACBCBAAAAABBCCBCCAABABBAAACCBCAAABACA.exe
4704	svchost_CBBCBCCAACCACBCAABBCBBAACBBBAACABCACBBCACABCCCBABACAAAC.exe
5972	svchost_CBBCBCCAACCACBCAABBCBBAACBBBAACABCACBBCACABCCCBABACAAAC.exe
6436	svchost_AABBABAACABBBCAACBCAACCACACCACBBCBBBBACBACABABCCACCAAAC.exe
6352	svchost_AABBABAACABBBCAACBCAACCACACCACBBCBBBBACBACABABCCACCAAAC.exe
4860	svchost_CAABCBBAABBCACBCBCABABBBBBCCCACBBCABCCAABAACABABCBCCABB.exe
1852	svchost_CBCBBCCBCBABCCCBBBCCCAACBABBCBBCCCBCBBBCABACABCABBCBCBC.exe
5028	svchost_CBCBBCCBCBABCCCBBBCCCAACBABBCBBCCCBCBBBCABACABCABBCBCBC.exe
3540	svchost_CAAABCCCBABABABABCABCCBCBBACCCBAABBCACCABBABCAABBABCACA.exe
1232	svchost_CAAABCCCBABABABABCABCCBCBBACCCBAABBCACCABBABCAABBABCACA.exe
7224	svchost_CBAACBAACABABCAAAABCCBCCBBACCBBBCBCBAACABBCCACCBBBCBBCB.exe
7336	svchost_AAACABCCCAACACACBBBCACCBBACBACACCCABCBBACCCBAACCABCBBBA.exe
7888	svchost_AAAABCCBABBBCBCBCBBACCABBBBCACBBACCABACCACBABCCBAAACBCC.exe
8124	svchost_CBACAABABCBBBBABBAAAAAABCAACCABCCABCBBABCCBCBCBBCAABCAA.exe
8160	svchost_CBACAABABCBBBBABBAAAAAABCAACCABCCABCBBABCCBCBCBBCAABCAA.exe
7180	svchost_ABACBCCCBAAACAAACCCBCBCABCCAABCBABCCACCCCABCABCCBABBAAA.exe
7204	svchost_ABACBCCCBAAACAAACCCBCBCABCCAABCBABCCACCCCABCABCCBABBAAA.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCCACAABABCCAACABBBBBAABCBACBABCABABACBCCBCACBBCBAAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBBCCBCBABCCCBBBCCCAACBABBCBBCCCBCBBBCABACABCABBCBCBC.exe"	svchost_CCAAABBBCCBBBBABABCCABCABAAACBAAAAAAACCCBBCBCAAABBBCCAC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCAACBBAABBACBBAABABCCCBCBABCBCAAABBBABAAACCBBAABABCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCAACBBAABBACBBAABABCCCBCBABCBCAAABBBABAAACCBBAABABCAA.exe"	svchost_BABBBCABAABBBBAACCCCABCAABBBCBCBBBACBAACBBABCCCCCBBBAAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACACAABCABBABCAAACACBABBBBABBCCBCCACBBBBABABBABACABBAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACACAABCABBABCAAACACBABBBBABBCCBCCACBBBBABABBABACABBAA.exe"	svchost_ACACCCCAAACABAAACACBBCBACBCBCBBACACAACAAAAAACABBBABAACB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBCBCBCCBACBBBCAAABACBAAACBAAACCABCBBACCBABAABCABBACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAABCCCBABABABABCABCCBCBBACCCBAABBCACCABBABCAABBABCACA.exe"	svchost_ABAACABCAAAABBCACBCCABABAACAACBABCCACAAACBCBCBBBBCABBCA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACBBAAABBAACACCCACBBBBBCABAACCBCACABCCBBABCAAABBCCCBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBACCAAABBABBCCCCBBACABACCABCBCABCCBCBAABCACBABBCBCBBC.exe"	svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAABAAACBAAACCABBBACCACBAAABCCCCAABCACCBCACAABCCBCABABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABBCBCCCABAACCBBABAACCBAABAABBCAACBBBAACBCBACAAAABCCB.exe"	svchost_CBBACCAAABBABBCCCCBBACABACCABCBCABCCBCBAABCACBABBCBCBBC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCB.exe"	svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABACABCBCAACBACCBCAACCBACCBCCBBBAACBACBBAAABBCBCCABAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCAAACABACCABABBCAABCABABBAABBAACCABBAACAABCACACCBCBB.exe"	svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCA.exe"	svchost_ACBABACBACABCAABACBCACABCCBBBCBBBBBCBCCBBCCACCAACBCABAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBBBBCBCBBAACCABABABBCBABCBABABCCCBCBACAAAAABACAABCBACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe"	svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABCBBACCCCCBBAAAAAABCAABCBCBBCBABCBBBCBACCCBCACBAAAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAACABCAAAABBCACBCCABABAACAACBABCCACAAACBCBCBBBBCABBCA.exe"	svchost_BCCCAAACABACCABABBCAABCABABBAABBAACCABBAACAABCACACCBCBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCAABACBCCCCCBACBCAABCACABBABACAAACABCBAABCBCBBBACACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACAABABCBBBBABBAAAAAABCAACCABCCABCBBABCCBCBCBBCAABCAA.exe"	svchost_CACACAABCABBABCAAACACBABBBBABBCCBCCACBBBBABABBABACABBAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAACCBBBCCAABBCCBABBBBCCCBACACBCCBCACABCBBCBCCACCCBBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACAACCBBBCCAABBCCBABBBBCCCBACACBCCBCACABCBBCBCCACCCBBBA.exe"	svchost_CAAABCCCBABABABABCABCCBCBBACCCBAABBCACCABBABCAABBABCACA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBAABABABACCCBABCCABAABACAAABABBCBCBCACBBCACABCCBBCCAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe"	2026-07-15_4a194671a0c90767e5b839a8c83585b3_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBABACBACABCAABACBCACABCCBBBCBBBBBCBCCBBCCACCAACBCABAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBABACBACABCAABACBCACABCCBBBCBBBBBCBCCBBCCACCAACBCABAA.exe"	svchost_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACAAABBABBCCBCCCAABBBACBAAACCBABCACBBCBACAAAABCBCBBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCCBBABBCABBCBCCCACBCBAAAAABBCCBCCAABABBAAACCBCAAABACA.exe"	svchost_AACCCAABCCBCAACBCCBBACCBCCCBCBBCCCBBBAAAACABBBABCCBCBCA.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
8920	sc.exe
4592	sc.exe
12532	sc.exe
8900	sc.exe
3692	sc.exe
5868	sc.exe
6960	sc.exe
8880	sc.exe
10616	sc.exe
12156	sc.exe
7256	sc.exe
5544	sc.exe
6988	sc.exe
5436	sc.exe
2896	sc.exe
10164	sc.exe
6300	sc.exe
5604	sc.exe
4952	sc.exe
8132	sc.exe
8772	sc.exe
4864	sc.exe
12808	sc.exe
7148	sc.exe
8464	sc.exe
3960	sc.exe
13096	sc.exe
5520	sc.exe
4452	sc.exe
2832	sc.exe
7324	sc.exe
9384	sc.exe
2052	sc.exe
8084	sc.exe
11404	sc.exe
6880	sc.exe
8604	sc.exe
10056	sc.exe
9296	sc.exe
7408	sc.exe
12556	sc.exe
3300	sc.exe
9456	sc.exe
10124	sc.exe
13264	sc.exe
11828	sc.exe
7052	sc.exe
1144	sc.exe
5708	sc.exe
5988	sc.exe
7568	sc.exe
7700	sc.exe
11680	sc.exe
2052	sc.exe
6264	sc.exe
8048	sc.exe
7248	sc.exe
9480	sc.exe
4176	sc.exe
7252	sc.exe
12100	sc.exe
1552	sc.exe
13772	sc.exe
1280	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBBCABAABBBBAACCCCABCAABBBCBCBBBACBAACBBABCCCCCBBBAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACAABABCBBBBABBAAAAAABCAACCABCCABCBBABCCBCBCBBCAABCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCCAABCCBCAACBCCBBACCBCCCBCBBCCCBBBAAAACABBBABCCBCBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
14036	schtasks.exe
14184	schtasks.exe
4240	schtasks.exe
6652	schtasks.exe
6744	schtasks.exe
7724	schtasks.exe
8344	schtasks.exe
3324	schtasks.exe
9504	schtasks.exe
11172	schtasks.exe
4908	schtasks.exe
10148	schtasks.exe
4552	schtasks.exe
12220	schtasks.exe
12096	schtasks.exe
7392	schtasks.exe
7388	schtasks.exe
7504	schtasks.exe
8872	schtasks.exe
11192	schtasks.exe
12228	schtasks.exe
14056	schtasks.exe
2884	schtasks.exe
5320	schtasks.exe
4152	schtasks.exe
9556	schtasks.exe
11440	schtasks.exe
8092	schtasks.exe
4612	schtasks.exe
5240	schtasks.exe
2052	schtasks.exe
4528	schtasks.exe
10532	schtasks.exe
10732	schtasks.exe
11556	schtasks.exe
11512	schtasks.exe
10032	schtasks.exe
10840	schtasks.exe
9152	schtasks.exe
6644	schtasks.exe
2584	schtasks.exe
2696	schtasks.exe
1272	schtasks.exe
10364	schtasks.exe
2868	schtasks.exe
8420	schtasks.exe
9432	schtasks.exe
12940	schtasks.exe
2360	schtasks.exe
5220	schtasks.exe
2524	schtasks.exe
6308	schtasks.exe
1628	schtasks.exe
8016	schtasks.exe
8380	schtasks.exe
8556	schtasks.exe
828	schtasks.exe
3656	schtasks.exe
7948	schtasks.exe
7528	schtasks.exe
7408	schtasks.exe
7148	schtasks.exe
1828	schtasks.exe
2872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2908	2026-07-15_4a194671a0c90767e5b839a8c83585b3_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
2908	2026-07-15_4a194671a0c90767e5b839a8c83585b3_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
2484	svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe
2484	svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe
4500	svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe
4500	svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe
2484	svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe
2484	svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe
2908	2026-07-15_4a194671a0c90767e5b839a8c83585b3_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
2908	2026-07-15_4a194671a0c90767e5b839a8c83585b3_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
3036	svchost_CBBACCAAABBABBCCCCBBACABACCABCBCABCCBCBAABCACBABBCBCBBC.exe
3036	svchost_CBBACCAAABBABBCCCCBBACABACCABCBCABCCBCBAABCACBABBCBCBBC.exe
5608	svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe
5608	svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe
6096	svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe
6096	svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe
5596	svchost_ABABBCBCCCABAACCBBABAACCBAABAABBCAACBBBAACBCBACAAAABCCB.exe
5596	svchost_ABABBCBCCCABAACCBBABAACCBAABAABBCAACBBBAACBCBACAAAABCCB.exe
1664	svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe
1664	svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe
5900	svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe
5900	svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe
5180	svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe
5180	svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe
4616	svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe
4616	svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe
3464	svchost_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCB.exe
3464	svchost_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCB.exe
3488	svchost_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCB.exe
3488	svchost_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCB.exe
4532	svchost_ACBABACBACABCAABACBCACABCCBBBCBBBBBCBCCBBCCACCAACBCABAA.exe
4532	svchost_ACBABACBACABCAABACBCACABCCBBBCBBBBBCBCCBBCCACCAACBCABAA.exe
5336	svchost_ACBABACBACABCAABACBCACABCCBBBCBBBBBCBCCBBCCACCAACBCABAA.exe
5336	svchost_ACBABACBACABCAABACBCACABCCBBBCBBBBBCBCCBBCCACCAACBCABAA.exe
4988	svchost_ACACCCCAAACABAAACACBBCBACBCBCBBACACAACAAAAAACABBBABAACB.exe
4988	svchost_ACACCCCAAACABAAACACBBCBACBCBCBBACACAACAAAAAACABBBABAACB.exe
5504	svchost_ACACCCCAAACABAAACACBBCBACBCBCBBACACAACAAAAAACABBBABAACB.exe
5504	svchost_ACACCCCAAACABAAACACBBCBACBCBCBBACACAACAAAAAACABBBABAACB.exe
3036	svchost_CBBACCAAABBABBCCCCBBACABACCABCBCABCCBCBAABCACBABBCBCBBC.exe
3036	svchost_CBBACCAAABBABBCCCCBBACABACCABCBCABCCBCBAABCACBABBCBCBBC.exe
4748	svchost_BCCCAAACABACCABABBCAABCABABBAABBAACCABBAACAABCACACCBCBB.exe
4748	svchost_BCCCAAACABACCABABBCAABCABABBAABBAACCABBAACAABCACACCBCBB.exe
848	svchost_BCCCAAACABACCABABBCAABCABABBAABBAACCABBAACAABCACACCBCBB.exe
848	svchost_BCCCAAACABACCABABBCAABCABABBAABBAACCABBAACAABCACACCBCBB.exe
6096	svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe
6096	svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe
5500	svchost_AACCCAABCCBCAACBCCBBACCBCCCBCBBCCCBBBAAAACABBBABCCBCBCA.exe
5500	svchost_AACCCAABCCBCAACBCCBBACCBCCCBCBBCCCBBBAAAACABBBABCCBCBCA.exe
4456	svchost_AACCCAABCCBCAACBCCBBACCBCCCBCBBCCCBBBAAAACABBBABCCBCBCA.exe
4456	svchost_AACCCAABCCBCAACBCCBBACCBCCCBCBBCCCBBBAAAACABBBABCCBCBCA.exe
3180	svchost_BCACBBABBBBCCCCABBBCCBABBCBABCBBBCBCCACCABBBACCAAAACBBB.exe
3180	svchost_BCACBBABBBBCCCCABBBCCBABBCBABCBBBCBCCACCABBBACCAAAACBBB.exe
4848	svchost_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCA.exe
4848	svchost_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCA.exe
5724	svchost_CCAAABBBCCBBBBABABCCABCABAAACBAAAAAAACCCBBCBCAAABBBCCAC.exe
5724	svchost_CCAAABBBCCBBBBABABCCABCABAAACBAAAAAAACCCBBCBCAAABBBCCAC.exe
2624	svchost_ABAACABCAAAABBCACBCCABABAACAACBABCCACAAACBCBCBBBBCABBCA.exe
2624	svchost_ABAACABCAAAABBCACBCCABABAACAACBABCCACAAACBCBCBBBBCABBCA.exe
6212	svchost_CCAAABBBCCBBBBABABCCABCABAAACBAAAAAAACCCBBCBCAAABBBCCAC.exe
6212	svchost_CCAAABBBCCBBBBABABCCABCABAAACBAAAAAAACCCBBCBCAAABBBCCAC.exe
3636	svchost_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCA.exe
3636	svchost_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCA.exe
1664	svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe
1664	svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	2908	2026-07-15_4a194671a0c90767e5b839a8c83585b3_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
Token: SeDebugPrivilege	2484	svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe
Token: SeDebugPrivilege	4500	svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe
Token: SeDebugPrivilege	3036	svchost_CBBACCAAABBABBCCCCBBACABACCABCBCABCCBCBAABCACBABBCBCBBC.exe
Token: SeDebugPrivilege	5608	svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe
Token: SeDebugPrivilege	6096	svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe
Token: SeDebugPrivilege	5596	svchost_ABABBCBCCCABAACCBBABAACCBAABAABBCAACBBBAACBCBACAAAABCCB.exe
Token: SeDebugPrivilege	1664	svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe
Token: SeDebugPrivilege	5900	svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe
Token: SeDebugPrivilege	5180	svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe
Token: SeDebugPrivilege	4616	svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe
Token: SeDebugPrivilege	3464	svchost_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCB.exe
Token: SeDebugPrivilege	3488	svchost_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCB.exe
Token: SeDebugPrivilege	4532	svchost_ACBABACBACABCAABACBCACABCCBBBCBBBBBCBCCBBCCACCAACBCABAA.exe
Token: SeDebugPrivilege	5336	svchost_ACBABACBACABCAABACBCACABCCBBBCBBBBBCBCCBBCCACCAACBCABAA.exe
Token: SeDebugPrivilege	4988	svchost_ACACCCCAAACABAAACACBBCBACBCBCBBACACAACAAAAAACABBBABAACB.exe
Token: SeDebugPrivilege	5504	svchost_ACACCCCAAACABAAACACBBCBACBCBCBBACACAACAAAAAACABBBABAACB.exe
Token: SeDebugPrivilege	4748	svchost_BCCCAAACABACCABABBCAABCABABBAABBAACCABBAACAABCACACCBCBB.exe
Token: SeDebugPrivilege	848	svchost_BCCCAAACABACCABABBCAABCABABBAABBAACCABBAACAABCACACCBCBB.exe
Token: SeDebugPrivilege	4456	svchost_AACCCAABCCBCAACBCCBBACCBCCCBCBBCCCBBBAAAACABBBABCCBCBCA.exe
Token: SeDebugPrivilege	5500	svchost_AACCCAABCCBCAACBCCBBACCBCCCBCBBCCCBBBAAAACABBBABCCBCBCA.exe
Token: SeDebugPrivilege	3180	svchost_BCACBBABBBBCCCCABBBCCBABBCBABCBBBCBCCACCABBBACCAAAACBBB.exe
Token: SeDebugPrivilege	4848	svchost_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCA.exe
Token: SeDebugPrivilege	5724	svchost_CCAAABBBCCBBBBABABCCABCABAAACBAAAAAAACCCBBCBCAAABBBCCAC.exe
Token: SeDebugPrivilege	2624	svchost_ABAACABCAAAABBCACBCCABABAACAACBABCCACAAACBCBCBBBBCABBCA.exe
Token: SeDebugPrivilege	6212	svchost_CCAAABBBCCBBBBABABCCABCABAAACBAAAAAAACCCBBCBCAAABBBCCAC.exe
Token: SeDebugPrivilege	3636	svchost_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCA.exe
Token: SeDebugPrivilege	6608	svchost_CACACAABCABBABCAAACACBABBBBABBCCBCCACBBBBABABBABACABBAA.exe
Token: SeDebugPrivilege	2804	svchost_CACACAABCABBABCAAACACBABBBBABBCCBCCACBBBBABABBABACABBAA.exe
Token: SeDebugPrivilege	6724	svchost_ABAACABCAAAABBCACBCCABABAACAACBABCCACAAACBCBCBBBBCABBCA.exe
Token: SeDebugPrivilege	6852	svchost_BABBBCABAABBBBAACCCCABCAABBBCBCBBBACBAACBBABCCCCCBBBAAA.exe
Token: SeDebugPrivilege	6872	svchost_BABBBCABAABBBBAACCCCABCAABBBCBCBBBACBAACBBABCCCCCBBBAAA.exe
Token: SeDebugPrivilege	3540	svchost_CAAABCCCBABABABABCABCCBCBBACCCBAABBCACCABBABCAABBABCACA.exe
Token: SeDebugPrivilege	1232	svchost_CAAABCCCBABABABABCABCCBCBBACCCBAABBCACCABBABCAABBABCACA.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2980	2908	2026-07-15_4a194671a0c90767e5b839a8c83585b3_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe	87
PID 2980 wrote to memory of 4908	2980	cmd.exe	89
PID 2908 wrote to memory of 4172	2908	2026-07-15_4a194671a0c90767e5b839a8c83585b3_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe	90
PID 4172 wrote to memory of 1844	4172	cmd.exe	93
PID 2908 wrote to memory of 2152	2908	2026-07-15_4a194671a0c90767e5b839a8c83585b3_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe	94
PID 2152 wrote to memory of 3028	2152	cmd.exe	96
PID 2484 wrote to memory of 5396	2484	svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe	100
PID 4500 wrote to memory of 6128	4500	svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe	102
PID 5396 wrote to memory of 2872	5396	cmd.exe	104
PID 6128 wrote to memory of 828	6128	cmd.exe	105
PID 2484 wrote to memory of 5112	2484	svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe	106
PID 4500 wrote to memory of 2080	4500	svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe	107
PID 2080 wrote to memory of 1280	2080	cmd.exe	110
PID 5112 wrote to memory of 5604	5112	cmd.exe	113
PID 4500 wrote to memory of 4296	4500	svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe	114
PID 4296 wrote to memory of 6080	4296	cmd.exe	116
PID 3036 wrote to memory of 2728	3036	svchost_CBBACCAAABBABBCCCCBBACABACCABCBCABCCBCBAABCACBABBCBCBBC.exe	120
PID 2728 wrote to memory of 5088	2728	cmd.exe	122
PID 3036 wrote to memory of 4352	3036	svchost_CBBACCAAABBABBCCCCBBACABACCABCBCABCCBCBAABCACBABBCBCBBC.exe	123
PID 4352 wrote to memory of 3768	4352	cmd.exe	125
PID 3036 wrote to memory of 5404	3036	svchost_CBBACCAAABBABBCCCCBBACABACCABCBCABCCBCBAABCACBABBCBCBBC.exe	126
PID 5608 wrote to memory of 2396	5608	svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe	128
PID 5404 wrote to memory of 676	5404	cmd.exe	130
PID 6096 wrote to memory of 3976	6096	svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe	131
PID 2396 wrote to memory of 3656	2396	cmd.exe	135
PID 3976 wrote to memory of 4584	3976	cmd.exe	137
PID 5608 wrote to memory of 2428	5608	svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe	138
PID 6096 wrote to memory of 5272	6096	svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe	140
PID 2428 wrote to memory of 5520	2428	cmd.exe	142
PID 5272 wrote to memory of 1504	5272	cmd.exe	143
PID 6096 wrote to memory of 5736	6096	svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe	145
PID 5608 wrote to memory of 4120	5608	svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe	148
PID 5736 wrote to memory of 4952	5736	cmd.exe	150
PID 4120 wrote to memory of 1844	4120	cmd.exe	152
PID 5596 wrote to memory of 2512	5596	svchost_ABABBCBCCCABAACCBBABAACCBAABAABBCAACBBBAACBCBACAAAABCCB.exe	155
PID 2512 wrote to memory of 2900	2512	cmd.exe	157
PID 5596 wrote to memory of 2644	5596	svchost_ABABBCBCCCABAACCBBABAACCBAABAABBCAACBBBAACBCBACAAAABCCB.exe	158
PID 2644 wrote to memory of 1368	2644	cmd.exe	160
PID 5596 wrote to memory of 4436	5596	svchost_ABABBCBCCCABAACCBBABAACCBAABAABBCAACBBBAACBCBACAAAABCCB.exe	161
PID 4436 wrote to memory of 5732	4436	cmd.exe	163
PID 1664 wrote to memory of 960	1664	svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe	165
PID 960 wrote to memory of 4240	960	cmd.exe	167
PID 1664 wrote to memory of 856	1664	svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe	168
PID 856 wrote to memory of 2956	856	cmd.exe	170
PID 1664 wrote to memory of 3436	1664	svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe	171
PID 3436 wrote to memory of 1904	3436	cmd.exe	173
PID 5900 wrote to memory of 2364	5900	svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe	177
PID 2364 wrote to memory of 4612	2364	cmd.exe	179
PID 5900 wrote to memory of 2552	5900	svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe	180
PID 2552 wrote to memory of 2300	2552	cmd.exe	182
PID 5900 wrote to memory of 3120	5900	svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe	183
PID 3120 wrote to memory of 3300	3120	cmd.exe	185
PID 5180 wrote to memory of 5992	5180	svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe	189
PID 4616 wrote to memory of 1700	4616	svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe	191
PID 5992 wrote to memory of 2884	5992	cmd.exe	193
PID 1700 wrote to memory of 4608	1700	cmd.exe	194
PID 5180 wrote to memory of 4732	5180	svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe	195
PID 4616 wrote to memory of 5280	4616	svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe	197
PID 5280 wrote to memory of 3480	5280	cmd.exe	199
PID 4732 wrote to memory of 4564	4732	cmd.exe	202
PID 4616 wrote to memory of 3136	4616	svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe	203
PID 5180 wrote to memory of 1584	5180	svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe	205
PID 3464 wrote to memory of 2040	3464	svchost_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCB.exe	207
PID 3136 wrote to memory of 3692	3136	cmd.exe	209

C:\Users\Admin\AppData\Local\Temp\2026-07-15_4a194671a0c90767e5b839a8c83585b3_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_4a194671a0c90767e5b839a8c83585b3_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABABABACCCBABCCABAABACAAABABBCBCBCACBBCACABCCBBCCAAAACCCBBACCBBBACCBBCBCCACABCBBCBCAABBCBBABCACBCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABABABACCCBABCCABAABACAAABABBCBCBCACBBCACABCCBBCCAAAACCCBBACCBBBACCBBCBCCACABCBBCBCAABBCBBABCACBCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBBCBBABBCABCCACABBBABCABBBBBCBCBBCBBAACBCCCCBABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe" start= auto displayName= "UserDataSvc_CBBBCBBABBCABCCACABBBABCABBBBBCBCBBCBBAACBCCCCBABAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBBCBBABBCABCCACABBBABCABBBBBCBCBBCBBAACBCCCCBABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe" start= auto displayName= "UserDataSvc_CBBBCBBABBCABCCACABBBABCABBBBBCBCBBCBBAACBCCCCBABAB"
    3⤵
    PID:1844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBBCBBABBCABCCACABBBABCABBBBBCBCBBCBBAACBCCCCBABAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBBCBBABBCABCCACABBBABCABBBBBCBCBBCBBAACBCCCCBABAB"
    3⤵
    PID:3028

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBAAABBAACACCCACBBBBBCABAACCBCACABCCBBABCAAABBCCCBACBAABAACCBBCAAABACBABAAAAACCBBBAABBBCBBBCABBCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCAAABBABBCCCCBBACABACCABCBCABCCBCBAABCACBABBCBCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBAAABBAACACCCACBBBBBCABAACCBCACABCCBBABCAAABBCCCBACBAABAACCBBCAAABACBABAAAAACCBBBAABBBCBBBCABBCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCAAABBABBCCCCBBACABACCABCBCABCCBCBAABCACBABBCBCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCAABABBBCABBABCCAACCBAABACAABBABCCBBBABABBCCBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCAAABBABBCCCCBBACABACCABCBCABCCBCBAABCACBABBCBCBBC.exe" start= auto displayName= "UserDataSvc_CABCAABABBBCABBABCCAACCBAABACAABBABCCBBBABABBCCBCCC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCAABABBBCABBABCCAACCBAABACAABBABCCBBBABABBCCBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCAAABBABBCCCCBBACABACCABCBCABCCBCBAABCACBABBCBCBBC.exe" start= auto displayName= "UserDataSvc_CABCAABABBBCABBABCCAACCBAABACAABBABCCBBBABABBCCBCCC"
    3⤵
    - Launches sc.exe
    PID:5604

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBABBCBBABCBBBCBACCBBCAABBAAAACBCACCBACBAAAAACACCAAABCCBCCACBBCCBCABCBACABBBCACBBCCCCCBCAAABBAACBBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBABBCBBABCBBBCBACCBBCAABBAAAACBCACCBACBAAAAACACCAAABCCBCCACBBCCBCABCBACABBBCACBBCCCCCBCAAABBAACBBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCAABABBBCABBABCCAACCBAABACAABBABCCBBBABABBCCBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe" start= auto displayName= "UserDataSvc_CABCAABABBBCABBABCCAACCBAABACAABBABCCBBBABABBCCBCCC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCAABABBBCABBABCCAACCBAABACAABBABCCBBBABABBCCBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe" start= auto displayName= "UserDataSvc_CABCAABABBBCABBABCCAACCBAABACAABBABCCBBBABABBCCBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCAABABBBCABBABCCAACCBAABACAABBABCCBBBABABBCCBCCC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCAABABBBCABBABCCAACCBAABACAABBABCCBBBABABBCCBCCC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6080

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCAAABBABBCCCCBBACABACCABCBCABCCBCBAABCACBABBCBCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCAAABBABBCCCCBBACABACCABCBCABCCBCBAABCACBABBCBCBBC.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABAAACBAAACCABBBACCACBAAABCCCCAABCACCBCACAABCCBCABABBABABBCBAABAAACAAABBABAABCCBACCBABAABCCBCCCABBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCBCCCABAACCBBABAACCBAABAABBCAACBBBAACBCBACAAAABCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABAAACBAAACCABBBACCACBAAABCCCCAABCACCBCACAABCCBCABABBABABBCBAABAAACAAABBABAABCCBACCBABAABCCBCCCABBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCBCCCABAACCBBABAACCBAABAABBCAACBBBAACBCBACAAAABCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:5088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACACBBABCAAABACBCCAACBAABCBAAABBBABBACBBCABACBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCBCCCABAACCBBABAACCBAABAABBCAACBBBAACBCBACAAAABCCB.exe" start= auto displayName= "UserDataSvc_BAACACBBABCAAABACBCCAACBAABCBAAABBBABBACBBCABACBACB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAACACBBABCAAABACBCCAACBAABCBAAABBBABBACBBCABACBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCBCCCABAACCBBABAACCBAABAABBCAACBBBAACBCBACAAAABCCB.exe" start= auto displayName= "UserDataSvc_BAACACBBABCAAABACBCCAACBAABCBAAABBBABBACBBCABACBACB"
    3⤵
    PID:3768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACACBBABCAAABACBCCAACBAABCBAAABBBABBACBBCABACBACB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5404
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAACACBBABCAAABACBCCAACBAABCBAAABBBABBACBBCABACBACB"
    3⤵
    PID:676

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAAACBBBABBABCABCABBAAAABBABCCCBCABCBBCBCACBACBCBBCABBBACCCABCABCBAABCCBBCABCBAACCBBCACCAAAACCBCBAAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAAACBBBABBABCABCABBAAAABBABCCCBCABCBBCBCACBACBCBBCABBBACCCABCABCBAABCCBBCABCBAACCBBCACCAAAACCBCBAAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCAACCBACBBABBCBCCCCBBCACBBBCBBCAACBBBBCCBCBCCCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe" start= auto displayName= "UserDataSvc_BCCAACCBACBBABBCBCCCCBBCACBBBCBBCAACBBBBCCBCBCCCBBC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCAACCBACBBABBCBCCCCBBCACBBBCBBCAACBBBBCCBCBCCCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe" start= auto displayName= "UserDataSvc_BCCAACCBACBBABBCBCCCCBBCACBBBCBBCAACBBBBCCBCBCCCBBC"
    3⤵
    - Launches sc.exe
    PID:5520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCAACCBACBBABBCBCCCCBBCACBBBCBBCAACBBBBCCBCBCCCBBC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCAACCBACBBABBCBCCCCBBCACBBBCBBCAACBBBBCCBCBCCCBBC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1844

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAACAACBCBBCABACAAAAACCCBBCCBAACCCCCACBCCBBCACACCCABB.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBBCBCBBAACCABABABBCBABCBABABCCCBCBACAAAAABACAABCBACCBBCBBBABAACBCCBCACACAABCACACCBBABCABACCAACCACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBBCBCBBAACCABABABBCBABCBABABCCCBCBACAAAAABACAABCBACCBBCBBBABAACBCCBCACACAABCACACCBBABCABACCAACCACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBABCBBBCBBABACBBCBABACCCCACCCAACABBCBABCBACCBCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe" start= auto displayName= "UserDataSvc_ABBABCBBBCBBABACBBCBABACCCCACCCAACABBCBABCBACCBCBCB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5272
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBABCBBBCBBABACBBCBABACCCCACCCAACABBCBABCBACCBCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe" start= auto displayName= "UserDataSvc_ABBABCBBBCBBABACBBCBABACCCCACCCAACABBCBABCBACCBCBCB"
    3⤵
    PID:1504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBABCBBBCBBABACBBCBABACCCCACCCAACABBCBABCBACCBCBCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5736
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBABCBBBCBBABACBBCBABACCCCACCCAACABBCBABCBACCBCBCB"
    3⤵
    - Launches sc.exe
    PID:4952

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCBCCCABAACCBBABAACCBAABAABBCAACBBBAACBCBACAAAABCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCBCCCABAACCBBABAACCBAABAABBCAACBBBAACBCBACAAAABCCB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACACACBACAACBCCAABCBACCBCAAABBCACCBBABABCABCABCABAAACCBCCCBBCBCABCACCBCBBCBCCACABCCBBACBCCCACACAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABBBBCCCCABBBCCBABBCBABCBBBCBCCACCABBBACCAAAACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACACACBACAACBCCAABCBACCBCAAABBCACCBBABABCABCABCABAAACCBCCCBBCBCABCACCBCBBCBCCACABCCBBACBCCCACACAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABBBBCCCCABBBCCBABBCBABCBBBCBCCACCABBBACCAAAACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:2900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACACACABCAAAAABAACBCCCBCABBCACAACAABBACCABBCCCCCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABBBBCCCCABBBCCBABBCBABCBBBCBCCACCABBBACCAAAACBBB.exe" start= auto displayName= "UserDataSvc_ACACACABCAAAAABAACBCCCBCABBCACAACAABBACCABBCCCCCBAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACACACABCAAAAABAACBCCCBCABBCACAACAABBACCABBCCCCCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABBBBCCCCABBBCCBABBCBABCBBBCBCCACCABBBACCAAAACBBB.exe" start= auto displayName= "UserDataSvc_ACACACABCAAAAABAACBCCCBCABBCACAACAABBACCABBCCCCCBAB"
    3⤵
    PID:1368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACACACABCAAAAABAACBCCCBCABBCACAACAABBACCABBCCCCCBAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACACACABCAAAAABAACBCCCBCABBCACAACAABBACCABBCCCCCBAB"
    3⤵
    PID:5732

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCBBBBBABCABBCBCACBBBBBCBAABABCBBAACBAABCBCACCBBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCBBBBBABCABBCBCACBBBBBCBAABABCBBAACBAABCBCACCBBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACAACBACACBBBBACBAAABBABBCCCBCACCCCAAAAABCCCBCACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCB.exe" start= auto displayName= "UserDataSvc_CCACAACBACACBBBBACBAAABBABBCCCBCACCCCAAAAABCCCBCACC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCACAACBACACBBBBACBAAABBABBCCCBCACCCCAAAAABCCCBCACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCB.exe" start= auto displayName= "UserDataSvc_CCACAACBACACBBBBACBAAABBABBCCCBCACCCCAAAAABCCCBCACC"
    3⤵
    PID:2956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACAACBACACBBBBACBAAABBABBCCCBCACCCCAAAAABCCCBCACC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCACAACBACACBBBBACBAAABBABBCCCBCACCCCAAAAABCCCBCACC"
    3⤵
    PID:1904

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBCABBBCBBBACCCBABBCBAABBAAACCCABBBCBAACABBAAABCCBB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCAAABCBBBBCBBBBABCAAAACBCCBABAAACCBCCBBCABABAACCCABABBAABCAABACCCCCCBACBBABCAAAABBCCBCBABABABABCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAABCCBCAACBCCBBACCBCCCBCBBCCCBBBAAAACABBBABCCBCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCAAABCBBBBCBBBBABCAAAACBCCBABAAACCBCCBBCABABAACCCABABBAABCAABACCCCCCBACBBABCAAAABBCCBCBABABABABCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAABCCBCAACBCCBBACCBCCCBCBBCCCBBBAAAACABBBABCCBCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCABBAACCACCBABABBCBACCBACCBABCAABAABCBACBBABBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAABCCBCAACBCCBBACCBCCCBCBBCCCBBBAAAACABBBABCCBCBCA.exe" start= auto displayName= "UserDataSvc_CCCCABBAACCACCBABABBCBACCBACCBABCAABAABCBACBBABBABC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCABBAACCACCBABABBCBACCBACCBABCAABAABCBACBBABBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAABCCBCAACBCCBBACCBCCCBCBBCCCBBBAAAACABBBABCCBCBCA.exe" start= auto displayName= "UserDataSvc_CCCCABBAACCACCBABABBCBACCBACCBABCAABAABCBACBBABBABC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCABBAACCACCBABABBCBACCBACCBABCAABAABCBACBBABBABC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCABBAACCACCBABABBCBACCBACCBABCAABAABCBACBBABBABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3300

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCBBCBCABBBACCCCABBCBCBCBAACBBCACBBCAABBABABCACBCCABBAABCBCCCABCCABAACCBCCACCBAAAABABABBCBCBCBBACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCCCAAACABAAACACBBCBACBCBCBBACACAACAAAAAACABBBABAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCBBCBCABBBACCCCABBCBCBCBAACBBCACBBCAABBABABCACBCCABBAABCBCCCABCCABAACCBCCACCBAAAABABABBCBCBCBBACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCCCAAACABAAACACBBCBACBCBCBBACACAACAAAAAACABBBABAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAAABCBCAABABCBCAABABBCACCBCCBACBACABCCABACACBCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCCCAAACABAAACACBBCBACBCBCBBACACAACAAAAAACABBBABAACB.exe" start= auto displayName= "UserDataSvc_CAAAABCBCAABABCBCAABABBCACCBCCBACBACABCCABACACBCCBC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5280
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAAABCBCAABABCBCAABABBCACCBCCBACBACABCCABACACBCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCCCAAACABAAACACBBCBACBCBCBBACACAACAAAAAACABBBABAACB.exe" start= auto displayName= "UserDataSvc_CAAAABCBCAABABCBCAABABBCACCBCCBACBACABCCABACACBCCBC"
    3⤵
    PID:3480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAAABCBCAABABCBCAABABBCACCBCCBACBACABCCABACACBCCBC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAAABCBCAABABCBCAABABBCACCBCCBACBACABCCABACACBCCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3692

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCBAAAABCBACCBABABCCCBBACCCACCABBCBACBABBABBABBCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACABCBCAACBACCBCAACCBACCBCCBBBAACBACBBAAABBCBCCABAACBBCBBBBCACBCAABCAACBABACCABBABAACACCBBACBCABBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAAACABACCABABBCAABCABABBAABBAACCABBAACAABCACACCBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACABCBCAACBACCBCAACCBACCBCCBBBAACBACBBAAABBCBCCABAACBBCBBBBCACBCAABCAACBABACCABBABAACACCBBACBCABBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAAACABACCABABBCAABCABABBAABBAACCABBAACAABCACACCBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBCACABCCBBBCCBABCABCCCBBBCACBBCBBCBCCCAABCCBBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAAACABACCABABBCAABCABABBAABBAACCABBAACAABCACACCBCBB.exe" start= auto displayName= "UserDataSvc_CBCBCACABCCBBBCCBABCABCCCBBBCACBBCBBCBCCCAABCCBBCBB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBCACABCCBBBCCBABCABCCCBBBCACBBCBBCBCCCAABCCBBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAAACABACCABABBCAABCABABBAABBAACCABBAACAABCACACCBCBB.exe" start= auto displayName= "UserDataSvc_CBCBCACABCCBBBCCBABCABCCCBBBCACBBCBBCBCCCAABCCBBCBB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBCACABCCBBBCCBABCABCCCBBBCACBBCBBCBCCCAABCCBBCBB"
  2⤵
  PID:1584
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBCACABCCBBBCCBABCABCCCBBBCACBBCBBCBCCCAABCCBBCBB"
    3⤵
    PID:5300

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABBBBCCCCABBBCCBABBCBABCBBBCBCCACCABBBACCAAAACBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBABBBBCCCCABBBCCBABBCBABCBBBCBCCACCABBBACCAAAACBBB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACAACCBCCBCAACABBBABBBBABBCBACABAACACACBCBCBCAACBAAACAACACBCCCCBCAAABAABBCCCCBAACBCACACBBCBCBABACABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABAACABBBCAACBCAACCACACCACBBCBBBBACBACABABCCACCAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACAACCBCCBCAACABBBABBBBABBCBACABAACACACBCBCBCAACBAAACAACACBCCCCBCAAABAABBCCCCBAACBCACACBBCBCBABACABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABAACABBBCAACBCAACCACACCACBBCBBBBACBACABABCCACCAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABACBABCCCABBCCCBBACBBAABCCCCCAABCCCCBBCBACCCCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABAACABBBCAACBCAACCACACCACBBCBBBBACBACABABCCACCAAAC.exe" start= auto displayName= "UserDataSvc_CCABACBABCCCABBCCCBBACBBAABCCCCCAABCCCCBBCBACCCCAAB"
  2⤵
  PID:6240
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABACBABCCCABBCCCBBACBBAABCCCCCAABCCCCBBCBACCCCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABAACABBBCAACBCAACCACACCACBBCBBBBACBACABABCCACCAAAC.exe" start= auto displayName= "UserDataSvc_CCABACBABCCCABBCCCBBACBBAABCCCCCAABCCCCBBCBACCCCAAB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABACBABCCCABBCCCBBACBBAABCCCCCAABCCCCBBCBACCCCAAB"
  2⤵
  PID:6368
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABACBABCCCABBCCCBBACBBAABCCCCCAABCCCCBBCBACCCCAAB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1632

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCABCCCABBCCAACCCBCACABBAABCBCCAACABBCBBBBCBABACCBBCBBBBCCACBCCAAABBABACCAAACAAACABBBBCCBBBBABABCBCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCAACBBCCABCCCCACCBAABABACBCBABCACBBBCACABAAACCBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCABCCCABBCCAACCCBCACABBAABCBCCAACABBCBBBBCBABACCBBCBBBBCCACBCCAAABBABACCAAACAAACABBBBCCBBBBABABCBCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCAACBBCCABCCCCACCBAABABACBCBABCACBBBCACABAAACCBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBBCBBCABBBBBABABCCBCCBAACCBBAAACBCACBBAAACCCCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCAACBBCCABCCCCACCBAABABACBCBABCACBBBCACABAAACCBACA.exe" start= auto displayName= "UserDataSvc_CABBBCBBCABBBBBABABCCBCCBAACCBBAAACBCACBBAAACCCCABC"
  2⤵
  PID:2600
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABBBCBBCABBBBBABABCCBCCBAACCBBAAACBCACBBAAACCCCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCAACBBCCABCCCCACCBAABABACBCBABCACBBBCACABAAACCBACA.exe" start= auto displayName= "UserDataSvc_CABBBCBBCABBBBBABABCCBCCBAACCBBAAACBCACBBAAACCCCABC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBBCBBCABBBBBABABCCBCCBAACCBBAAACBCACBBAAACCCCABC"
  2⤵
  PID:5352
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABBBCBBCABBBBBABABCCBCCBAACCBBAAACBCACBBAAACCCCABC"
    3⤵
    PID:4232

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBBBBABABAABCCACCCACCCBCBBBBBCABCCCCCBBBBCBCBABBBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBABACBACABCAABACBCACABCCBBBCBBBBBCBCCBBCCACCAACBCABAACCCBCCACBAAAABAACAAAACCCCACBABABBBCCACBCBCACBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABACBACABCAABACBCACABCCBBBCBBBBBCBCCBBCCACCAACBCABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBABACBACABCAABACBCACABCCBBBCBBBBBCBCCBBCCACCAACBCABAACCCBCCACBAAAABAACAAAACCCCACBABABBBCCACBCBCACBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABACBACABCAABACBCACABCCBBBCBBBBBCBCCBBCCACCAACBCABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCAAACACBBABCABACBACCCBCABBAACBCCABAABABCCBBBBCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABACBACABCAABACBCACABCCBBBCBBBBBCBCCBBCCACCAACBCABAA.exe" start= auto displayName= "UserDataSvc_ACCAAACACBBABCABACBACCCBCABBAACBCCABAABABCCBBBBCCCC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4676
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCAAACACBBABCABACBACCCBCABBAACBCCABAABABCCBBBBCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABACBACABCAABACBCACABCCBBBCBBBBBCBCCBBCCACCAACBCABAA.exe" start= auto displayName= "UserDataSvc_ACCAAACACBBABCABACBACCCBCABBAACBCCABAABABCCBBBBCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCAAACACBBABCABACBACCCBCABBAACBCCABAABABCCBBBBCCCC"
  2⤵
  PID:5324
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCAAACACBBABCABACBACCCBCABBAACBCCABAABABCCBBBBCCCC"
    3⤵
    PID:2896

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAABCCBCAACBCCBBACCBCCCBCBBCCCBBBAAAACABBBABCCBCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAABCCBCAACBCCBBACCBCCCBCBBCCCBBBAAAACABBBABCCBCBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACAAABBABBCCBCCCAABBBACBAAACCBABCACBBCBACAAAABCBCBBABCBAABCABCCCAABCBCABBCAACAACACCAABAACCCABCCAAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBABBCABBCBCCCACBCBAAAAABBCCBCCAABABBAAACCBCAAABACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACAAABBABBCCBCCCAABBBACBAAACCBABCACBBCBACAAAABCBCBBABCBAABCABCCCAABCBCABBCAACAACACCAABAACCCABCCAAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBABBCABBCBCCCACBCBAAAAABBCCBCCAABABBAAACCBCAAABACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBACBBAAAACCAACACCCACCBBAAACCACABBCACBBABBCBBCBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBABBCABBCBCCCACBCBAAAAABBCCBCCAABABBAAACCBCAAABACA.exe" start= auto displayName= "UserDataSvc_ABBACBBAAAACCAACACCCACCBBAAACCACABBCACBBABBCBBCBACB"
  2⤵
  PID:6748
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBACBBAAAACCAACACCCACCBBAAACCACABBCACBBABBCBBCBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBABBCABBCBCCCACBCBAAAAABBCCBCCAABABBAAACCBCAAABACA.exe" start= auto displayName= "UserDataSvc_ABBACBBAAAACCAACACCCACCBBAAACCACABBCACBBABBCBBCBACB"
    3⤵
    - Launches sc.exe
    PID:6880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBACBBAAAACCAACACCCACCBBAAACCACABBCACBBABBCBBCBACB"
  2⤵
  PID:7004
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBACBBAAAACCAACACCCACCBBAAACCACABBCACBBABBCBBCBACB"
    3⤵
    PID:7112

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAABCCBCAACBCCBBACCBCCCBCBBCCCBBBAAAACABBBABCCBCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAABCCBCAACBCCBBACCBCCCBCBBCCCBBBAAAACABBBABCCBCBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBACAACCACCCACCCACACBBCBACBBAABABBCBCBBBCAABBCBABBCABBCCABBABCAAAABABCBBABCCCBBBCAABAABCCBCABBBAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCAACCACBCAABBCBBAACBBBAACABCACBBCACABCCCBABACAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBACAACCACCCACCCACACBBCBACBBAABABBCBCBBBCAABBCBABBCABBCCABBABCAAAABABCBBABCCCBBBCAABAABCCBCABBBAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCAACCACBCAABBCBBAACBBBAACABCACBBCACABCCCBABACAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBAACCACABCBCACCBBAABCCBCCCCBBCACBBACBCACCABBBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCAACCACBCAABBCBBAACBBBAACABCACBBCACABCCCBABACAAAC.exe" start= auto displayName= "UserDataSvc_ABCBAACCACABCBCACCBBAABCCBCCCCBBCACBBACBCACCABBBCAC"
  2⤵
  PID:6784
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBAACCACABCBCACCBBAABCCBCCCCBBCACBBACBCACCABBBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCAACCACBCAABBCBBAACBBBAACABCACBBCACABCCCBABACAAAC.exe" start= auto displayName= "UserDataSvc_ABCBAACCACABCBCACCBBAABCCBCCCCBBCACBBACBCACCABBBCAC"
    3⤵
    - Launches sc.exe
    PID:6960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBAACCACABCBCACCBBAABCCBCCCCBBCACBBACBCACCABBBCAC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7056
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBAACCACABCBCACCBBAABCCBCCCCBBCACBBACBCACCABBBCAC"
    3⤵
    - Launches sc.exe
    PID:7148

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCCCAAACABAAACACBBCBACBCBCBBACACAACAAAAAACABBBABAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCCCAAACABAAACACBBCBACBCBCBBACACAACAAAAAACABBBABAACB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCAABBBABCBBCACCBCACBABBBCBCABBABCAABBCBABCCBBCBCACBCCCBBCAAABAABACACAABBAACBCCABBAACACBCBCABCBCCAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABBBCCBBBBABABCCABCABAAACBAAAAAAACCCBBCBCAAABBBCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCAABBBABCBBCACCBCACBABBBCBCABBABCAABBCBABCCBBCBCACBCCCBBCAAABAABACACAABBAACBCCABBAACACBCBCABCBCCAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABBBCCBBBBABABCCABCABAAACBAAAAAAACCCBBCBCAAABBBCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:1280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCACAACCBACBCBCCABCCAABAAAABBBCCBACBACBCABAABABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABBBCCBBBBABABCCABCABAAACBAAAAAAACCCBBCBCAAABBBCCAC.exe" start= auto displayName= "UserDataSvc_CCCCACAACCBACBCBCCABCCAABAAAABBBCCBACBACBCABAABABCC"
  2⤵
  PID:1280
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCACAACCBACBCBCCABCCAABAAAABBBCCBACBACBCABAABABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABBBCCBBBBABABCCABCABAAACBAAAAAAACCCBBCBCAAABBBCCAC.exe" start= auto displayName= "UserDataSvc_CCCCACAACCBACBCBCCABCCAABAAAABBBCCBACBACBCABAABABCC"
    3⤵
    - Launches sc.exe
    PID:5988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCACAACCBACBCBCCABCCAABAAAABBBCCBACBACBCABAABABCC"
  2⤵
  PID:4908
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCACAACCBACBCBCCABCCAABAAAABBBCCBACBACBCABAABABCC"
    3⤵
    PID:6176

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCCCAAACABAAACACBBCBACBCBCBBACACAACAAAAAACABBBABAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCCCAAACABAAACACBBCBACBCBCBBACACAACAAAAAACABBBABAACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACAABCABBABCAAACACBABBBBABBCCBCCACBBBBABABBABACABBAAAAAABAAACACBBABAAACCAABCCCBBCCCCCACCBCCCBBAAAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACAABCABBABCAAACACBABBBBABBCCBCCACBBBBABABBABACABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACAABCABBABCAAACACBABBBBABBCCBCCACBBBBABABBABACABBAAAAAABAAACACBBABAAACCAABCCCBBCCCCCACCBCCCBBAAAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACAABCABBABCAAACACBABBBBABBCCBCCACBBBBABABBABACABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCAAAACBBCABCCBBAAAACABBAABABABCABABBAAABBCBABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACAABCABBABCAAACACBABBBBABBCCBCCACBBBBABABBABACABBAA.exe" start= auto displayName= "UserDataSvc_CBCCAAAACBBCABCCBBAAAACABBAABABABCABABBAAABBCBABBAB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2984
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCAAAACBBCABCCBBAAAACABBAABABABCABABBAAABBCBABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACAABCABBABCAAACACBABBBBABBCCBCCACBBBBABABBABACABBAA.exe" start= auto displayName= "UserDataSvc_CBCCAAAACBBCABCCBBAAAACABBAABABABCABABBAAABBCBABBAB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCAAAACBBCABCCBBAAAACABBAABABABCABABBAAABBCBABBAB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6232
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCCAAAACBBCABCCBBAAAACABBAABABABCABABBAAABBCBABBAB"
    3⤵
    PID:6512

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAAACABACCABABBCAABCABABBAABBAACCABBAACAABCACACCBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAAACABACCABABBCAABCABABBAABBAACCABBAACAABCACACCBCBB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAAAAACABBACCACACBBACBCABBBCBAAABCABBBBBBACCCBABABAABCABBBBBCBCACCBABCACBACAABACCCABCCCCAABCABCCBAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCABAABBBBAACCCCABCAABBBCBCBBBACBAACBBABCCCCCBBBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAAAAACABBACCACACBBACBCABBBCBAAABCABBBBBBACCCBABABAABCABBBBBCBCACCBABCACBACAABACCCABCCCCAABCABCCBAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCABAABBBBAACCCCABCAABBBCBCBBBACBAACBBABCCCCCBBBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:5220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCAAACCCBBAABBBACBAACAABCACCBCBBBACCABBCAAACACBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCABAABBBBAACCCCABCAABBBCBCBBBACBAACBBABCCCCCBBBAAA.exe" start= auto displayName= "UserDataSvc_CBBCAAACCCBBAABBBACBAACAABCACCBCBBBACCABBCAAACACBBB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4984
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2524
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCAAACCCBBAABBBACBAACAABCACCBCBBBACCABBCAAACACBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCABAABBBBAACCCCABCAABBBCBCBBBACBAACBBABCCCCCBBBAAA.exe" start= auto displayName= "UserDataSvc_CBBCAAACCCBBAABBBACBAACAABCACCBCBBBACCABBCAAACACBBB"
    3⤵
    PID:6184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCAAACCCBBAABBBACBAACAABCACCBCBBBACCABBCAAACACBBB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6496
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBCAAACCCBBAABBBACBAACAABCACCBCBBBACCABBCAAACACBBB"
    3⤵
    PID:6680

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAAACABACCABABBCAABCABABBAABBAACCABBAACAABCACACCBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAAACABACCABABBCAABCABABBAABBAACCABBAACAABCACACCBCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBBACCCCCBBAAAAAABCAABCBCBBCBABCBBBCBACCCBCACBAAAACBCBCCCBBAAACCACAAAABBBACACBBABBCABBCCCACBCACAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACABCAAAABBCACBCCABABAACAACBABCCACAAACBCBCBBBBCABBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBBACCCCCBBAAAAAABCAABCBCBBCBABCBBBCBACCCBCACBAAAACBCBCCCBBAAACCACAAAABBBACACBBABBCABBCCCACBCACAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACABCAAAABBCACBCCABABAACAACBABCCACAAACBCBCBBBBCABBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCACCCAABBBCBCBCACCBABBBAACCAACCACCCBBBCCCCBAACCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACABCAAAABBCACBCCABABAACAACBABCCACAAACBCBCBBBBCABBCA.exe" start= auto displayName= "UserDataSvc_ABCACCCAABBBCBCBCACCBABBBAACCAACCACCCBBBCCCCBAACCCA"
  2⤵
  PID:8
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCACCCAABBBCBCBCACCBABBBAACCAACCACCCBBBCCCCBAACCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACABCAAAABBCACBCCABABAACAACBABCCACAAACBCBCBBBBCABBCA.exe" start= auto displayName= "UserDataSvc_ABCACCCAABBBCBCBCACCBABBBAACCAACCACCCBBBCCCCBAACCCA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCACCCAABBBCBCBCACCBABBBAACCAACCACCCBBBCCCCBAACCCA"
  2⤵
  PID:6200
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCACCCAABBBCBCBCACCBABBBAACCAACCACCCBBBCCCCBAACCCA"
    3⤵
    PID:6692

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABACBACABCAABACBCACABCCBBBCBBBBBCBCCBBCCACCAACBCABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABACBACABCAABACBCACABCCBBBCBBBBBCBCCBBCCACCAACBCABAA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACACCABCCCCBBBCBBACCCBCCCAAACACCABCCCBCAACCBBAABBCAABABBABBCCCAACAACCBBCACCBCCAACAABCABCCAACAABCABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACACCABCCCCBBBCBBACCCBCCCAAACACCABCCCBCAACCBBAABBCAABABBABBCCCAACAACCBBCACCBCCAACAABCABCCAACAABCABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:3016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBABBCBACCCCCCBBBABCBAAABBBCCCCACCBCACACCBCBCBCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCA.exe" start= auto displayName= "UserDataSvc_ABBABBCBACCCCCCBBBABCBAAABBBCCCCACCBCACACCBCBCBCCCA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2840
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBABBCBACCCCCCBBBABCBAAABBBCCCCACCBCACACCBCBCBCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCA.exe" start= auto displayName= "UserDataSvc_ABBABBCBACCCCCCBBBABCBAAABBBCCCCACCBCACACCBCBCBCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBABBCBACCCCCCBBBABCBAAABBBCCCCACCBCACACCBCBCBCCCA"
  2⤵
  PID:2216
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBABBCBACCCCCCBBBABCBAAABBBCCCCACCBCACACCBCBCBCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4452

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABACBACABCAABACBCACABCCBBBCBBBBBCBCCBBCCACCAACBCABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABACBACABCAABACBCACABCCBBBCBBBBBCBCCBBCCACCAACBCABAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCAABCCBCBCAABACAABCBABCAAACBABCCABBBACCBABBCBABCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCAABCCBCBCAABACAABCBABCAAACBABCCABBBACCBABBCBABCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCACCCABCACACACBACBCABACBBCCBBACACACAABCBBACAAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCA.exe" start= auto displayName= "UserDataSvc_BBCACCCABCACACACBACBCABACBBCCBBACACACAABCBBACAAAABB"
  2⤵
  PID:5376
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCACCCABCACACACBACBCABACBBCCBBACACACAABCBBACAAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCA.exe" start= auto displayName= "UserDataSvc_BBCACCCABCACACACBACBCABACBBCCBBACACACAABCBBACAAAABB"
    3⤵
    - Launches sc.exe
    PID:5544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCACCCABCACACACBACBCABACBBCCBBACACACAABCBBACAAAABB"
  2⤵
  PID:2876
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCACCCABCACACACBACBCABACBBCCBBACACACAABCBBACAAAABB"
    3⤵
    PID:5240

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCAACBBCCABCCCCACCBAABABACBCBABCACBBBCACABAAACCBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCAACBBCCABCCCCACCBAABABACBCBABCACBBBCACABAAACCBACA.exe
1⤵
- Executes dropped EXE
PID:1556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABBACCAACBCBABBABCABACBACABCABBCBACCBBBBBACBBCCABBCBABBBBACBCCBABACBCBCBAABBBCABCCACABAAABBCCBCCAAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCACCCBBCABBBBAACACCCAABCBCCCCBCCCAACCABCCCCCCABBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABBACCAACBCBABBABCABACBACABCABBCBACCBBBBBACBBCCABBCBABBBBACBCCBABACBCBCBAABBBCABCCACABAAABBCCBCCAAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCACCCBBCABBBBAACACCCAABCBCCCCBCCCAACCABCCCCCCABBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACACABABABABBCBACAACBBABBCBCBAACBBBCCACBCAAACABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCACCCBBCABBBBAACACCCAABCBCCCCBCCCAACCABCCCCCCABBBB.exe" start= auto displayName= "UserDataSvc_BAACACABABABABBCBACAACBBABBCBCBAACBBBCCACBCAAACABBA"
  2⤵
  PID:9304
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAACACABABABABBCBACAACBBABBCBCBAACBBBCCACBCAAACABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCACCCBBCABBBBAACACCCAABCBCCCCBCCCAACCABCCCCCCABBBB.exe" start= auto displayName= "UserDataSvc_BAACACABABABABBCBACAACBBABBCBCBAACBBBCCACBCAAACABBA"
    3⤵
    - Launches sc.exe
    PID:9480

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCAACBBCCABCCCCACCBAABABACBCBABCACBBBCACABAAACCBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCAACBBCCABCCCCACCBAABABACBCBABCACBBBCACABAAACCBACA.exe
1⤵
- Executes dropped EXE
PID:3832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACAABBAAABBACCBBAAABAACACACAAAACBCCCBCACCCBBBBAAAABBAAACBCCCBACAABBACBBCCAABBBCACBCCBCCCBBCCCAACBACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABBAAABBACCBBAAABAACACACAAAACBCCCBCACCCBBBBAAAABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACAABBAAABBACCBBAAABAACACACAAAACBCCCBCACCCBBBBAAAABBAAACBCCCBACAABBACBBCCAABBBCACBCCBCCCBBCCCAACBACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABBAAABBACCBBAAABAACACACAAAACBCCCBCACCCBBBBAAAABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBBABCCCABAACBBBBAACCABAACBBBABAABAAACCCAABAABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABBAAABBACCBBAAABAACACACAAAACBCCCBCACCCBBBBAAAABBAA.exe" start= auto displayName= "UserDataSvc_AABBBABCCCABAACBBBBAACCABAACBBBABAABAAACCCAABAABBAC"
  2⤵
  PID:8660
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBBABCCCABAACBBBBAACCABAACBBBABAABAAACCCAABAABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABBAAABBACCBBAAABAACACACAAAACBCCCBCACCCBBBBAAAABBAA.exe" start= auto displayName= "UserDataSvc_AABBBABCCCABAACBBBBAACCABAACBBBABAABAAACCCAABAABBAC"
    3⤵
    PID:9444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBBABCCCABAACBBBBAACCABAACBBBABAABAAACCCAABAABBAC"
  2⤵
  PID:9540
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBBABCCCABAACBBBBAACCABAACBBBABAABAAACCCAABAABBAC"
    3⤵
    PID:9828

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACABBBBACCAAABBBBCCCBACACABCCAAAABCCCCBBCABAABABAACBBBBBCCCCCCCCBAACACBAAACCCBBCABCAABCAABBBCAAAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBAABBCACBCBCABABBBBBCCCACBBCABCCAABAACABABCBCCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6444
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACABBBBACCAAABBBBCCCBACACABCCAAAABCCCCBBCABAABABAACBBBBBCCCCCCCCBAACACBAAACCCBBCABCAABCAABBBCAAAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBAABBCACBCBCABABBBBBCCCACBBCABCCAABAACABABCBCCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:6996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBCCCCACBBCABCAACCBAABACCACBBBBCBBACCCACCABCBBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBAABBCACBCBCABABBBBBCCCACBBCABCCAABAACABABCBCCABB.exe" start= auto displayName= "UserDataSvc_ABBBCCCCACBBCABCAACCBAABACCACBBBBCBBACCCACCABCBBBBB"
  2⤵
  PID:6844
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBBCCCCACBBCABCAACCBAABACCACBBBBCBBACCCACCABCBBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBAABBCACBCBCABABBBBBCCCACBBCABCCAABAACABABCBCCABB.exe" start= auto displayName= "UserDataSvc_ABBBCCCCACBBCABCAACCBAABACCACBBBBCBBACCCACCABCBBBBB"
    3⤵
    PID:6816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBCCCCACBBCABCAACCBAABACCACBBBBCBBACCCACCABCBBBBB"
  2⤵
  PID:6768
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBBCCCCACBBCABCAACCBAABACCACBBBBCBBACCCACCABCBBBBB"
    3⤵
    PID:460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCBCCBBAAACBBCBCBBABAACAABACCACBBABCBCABBCABCCBABCA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBABACACBACBBBACACBBBAACBBCCCACABCBAAAAABCACBBACABBAACBACACBCCAAAACABCACBBABACBABCACCBABCCCBCACBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABCCCAACACACBBBCACCBBACBACACCCABCBBACCCBAACCABCBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBABACACBACBBBACACBBBAACBBCCCACABCBAAAAABCACBBACABBAACBACACBCCAAAACABCACBBABACBABCACCBABCCCBCACBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABCCCAACACACBBBCACCBBACBACACCCABCBBACCCBAACCABCBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCACBBCAACBCAACCCBCAABCBAAAABBBCBBCBABCACCCACABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABCCCAACACACBBBCACCBBACBACACCCABCBBACCCBAACCABCBBBA.exe" start= auto displayName= "UserDataSvc_CBCCACBBCAACBCAACCCBCAABCBAAAABBBCBBCBABCACCCACABCB"
  2⤵
  PID:6764
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCACBBCAACBCAACCCBCAABCBAAAABBBCBBCBABCACCCACABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABCCCAACACACBBBCACCBBACBACACCCABCBBACCCBAACCABCBBBA.exe" start= auto displayName= "UserDataSvc_CBCCACBBCAACBCAACCCBCAABCBAAAABBBCBBCBABCACCCACABCB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCACBBCAACBCAACCCBCAABCBAAAABBBCBBCBABCACCCACABCB"
  2⤵
  PID:5100
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCCACBBCAACBCAACCCBCAABCBAAAABBBCBBCBABCACCCACABCB"
    3⤵
    PID:1228

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACAABCABBABCAAACACBABBBBABBCCBCCACBBBBABABBABACABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACAABCABBABCAAACACBABBBBABBCCBCCACBBBBABABBABACABBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCAABACBCCCCCBACBCAABCACABBABACAAACABCBAABCBCBBBACACBAACBCCCBACBCBCCABCBACAAACCACCABBBACBBBBBCCABCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAABABCBBBBABBAAAAAABCAACCABCCABCBBABCCBCBCBBCAABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCAABACBCCCCCBACBCAABCACABBABACAAACABCBAABCBCBBBACACBAACBCCCBACBCBCCABCBACAAACCACCABBBACBBBBBCCABCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAABABCBBBBABBAAAAAABCAACCABCCABCBBABCCBCBCBBCAABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:7724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCACCCAAABCAABBCCCACCABBCABCABCACBCBBCBBBACBAAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAABABCBBBBABBAAAAAABCAACCABCCABCBBABCCBCBCBBCAABCAA.exe" start= auto displayName= "UserDataSvc_AACCACCCAAABCAABBCCCACCABBCABCABCACBCBBCBBBACBAAAAA"
  2⤵
  PID:7752
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACCACCCAAABCAABBCCCACCABBCABCABCACBCBBCBBBACBAAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAABABCBBBBABBAAAAAABCAACCABCCABCBBABCCBCBCBBCAABCAA.exe" start= auto displayName= "UserDataSvc_AACCACCCAAABCAABBCCCACCABBCABCABCACBCBBCBBBACBAAAAA"
    3⤵
    PID:7948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCACCCAAABCAABBCCCACCABBCABCABCACBCBBCBBBACBAAAAA"
  2⤵
  PID:8056
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACCACCCAAABCAABBCCCACCABBCABCABCACBCBBCBBBACBAAAAA"
    3⤵
    - Launches sc.exe
    PID:8132

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABBBCCBBBBABABCCABCABAAACBAAAAAAACCCBBCBCAAABBBCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABBBCCBBBBABABCCABCABAAACBAAAAAAACCCBBCBCAAABBBCCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCCACAABABCCAACABBBBBAABCBACBABCABABACBCCBCACBBCBAAAAABBACAAABBBCAABBABAABCAACCABCACBABBACBABCACCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBCCBCBABCCCBBBCCCAACBABBCBBCCCBCBBBCABACABCABBCBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCCACAABABCCAACABBBBBAABCBACBABCABABACBCCBCACBBCBAAAAABBACAAABBBCAABBABAABCAACCABCACBABBACBABCACCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBCCBCBABCCCBBBCCCAACBABBCBBCCCBCBBBCABACABCABBCBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCABAABABAAACACCCACBCACBACAABCBABAABBCCCACACCBCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBCCBCBABCCCBBBCCCAACBABBCBBCCCBCBBBCABACABCABBCBCBC.exe" start= auto displayName= "UserDataSvc_CCCABAABABAAACACCCACBCACBACAABCBABAABBCCCACACCBCAAB"
  2⤵
  PID:6320
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCABAABABAAACACCCACBCACBACAABCBABAABBCCCACACCBCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBCCBCBABCCCBBBCCCAACBABBCBBCCCBCBBBCABACABCABBCBCBC.exe" start= auto displayName= "UserDataSvc_CCCABAABABAAACACCCACBCACBACAABCBABAABBCCCACACCBCAAB"
    3⤵
    - Launches sc.exe
    PID:6988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCABAABABAAACACCCACBCACBACAABCBABAABBCCCACACCBCAAB"
  2⤵
  PID:5572
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCABAABABAAACACCCACBCACBACAABCBABAABBCCCACACCBCAAB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4524

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACABCAAAABBCACBCCABABAACAACBABCCACAAACBCBCBBBBCABBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACABCAAAABBCACBCCABABAACAACBABCCACAAACBCBCBBBBCABBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCBCBCCBACBBBCAAABACBAAACBAAACCABCBBACCBABAABCABBACABACABCBBCAAACAABBAABBBCACCCAACABBBCCCCCABAAACBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCCCBABABABABCABCCBCBBACCCBAABBCACCABBABCAABBABCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCBCBCCBACBBBCAAABACBAAACBAAACCABCBBACCBABAABCABBACABACABCBBCAAACAABBAABBBCACCCAACABBBCCCCCABAAACBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCCCBABABABABCABCCBCBBACCCBAABBCACCABBABCAABBABCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCBCBBAACBAAACABABBBCBBCBACAAAABCACCCCABCBABABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCCCBABABABABCABCCBCBBACCCBAABBCACCABBABCAABBABCACA.exe" start= auto displayName= "UserDataSvc_ACCCBCBBAACBAAACABABBBCBBCBACAAAABCACCCCABCBABABBAC"
  2⤵
  PID:2972
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCCBCBBAACBAAACABABBBCBBCBACAAAABCACCCCABCBABABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCCCBABABABABCABCCBCBBACCCBAABBCACCABBABCAABBABCACA.exe" start= auto displayName= "UserDataSvc_ACCCBCBBAACBAAACABABBBCBBCBACAAAABCACCCCABCBABABBAC"
    3⤵
    - Launches sc.exe
    PID:6300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCBCBBAACBAAACABABBBCBBCBACAAAABCACCCCABCBABABBAC"
  2⤵
  PID:6484
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCCBCBBAACBAAACABABBBCBBCBACAAAABCACCCCABCBABABBAC"
    3⤵
    PID:6988

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABBBCCBBBBABABCCABCABAAACBAAAAAAACCCBBCBCAAABBBCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABBBCCBBBBABABCCABCABAAACBAAAAAAACCCBBCBCAAABBBCCAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCACCACACCACCBABAABABCABACCBCBCCBBAAAACCACCCCBCBCCAABCCBABBCCBBCACBCBCBBBAAAACAACCABBAACCBBCBBAACCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBAACABABCAAAABCCBCCBBACCBBBCBCBAACABBCCACCBBBCBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5320
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCACCACACCACCBABAABABCABACCBCBCCBBAAAACCACCCCBCBCCAABCCBABBCCBBCACBCBCBBBAAAACAACCABBAACCBBCBBAACCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBAACABABCAAAABCCBCCBBACCBBBCBCBAACABBCCACCBBBCBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCABBCCACBBCABCBCCABBCCCACAAACACCBBCBBCCBCCAACBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBAACABABCAAAABCCBCCBBACCBBBCBCBAACABBCCACCBBBCBBCB.exe" start= auto displayName= "UserDataSvc_CACCABBCCACBBCABCBCCABBCCCACAAACACCBBCBBCCBCCAACBBB"
  2⤵
  PID:4132
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACCABBCCACBBCABCBCCABBCCCACAAACACCBBCBBCCBCCAACBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBAACABABCAAAABCCBCCBBACCBBBCBCBAACABBCCACCBBBCBBCB.exe" start= auto displayName= "UserDataSvc_CACCABBCCACBBCABCBCCABBCCCACAAACACCBBCBBCCBCCAACBBB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCABBCCACBBCABCBCCABBCCCACAAACACCBBCBBCCBCCAACBBB"
  2⤵
  PID:6292
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2584
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACCABBCCACBBCABCBCCABBCCCACAAACACCBBCBBCCBCCAACBBB"
    3⤵
    - Launches sc.exe
    PID:2832

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACAABCABBABCAAACACBABBBBABBCCBCCACBBBBABABBABACABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACAABCABBABCAAACACBABBBBABBCCBCCACBBBBABABBABACABBAA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCBBCAABBACAAACABBBBCCBABCAACCCCCABCABBBCACABBCABACCCBCCACAACCBCCBBACCCBACBAABBAAABCCBCCBBCAABBBBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABCCBABBBCBCBCBBACCABBBBCACBBACCABACCACBABCCBAAACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCBBCAABBACAAACABBBBCCBABCAACCCCCABCABBBCACABBCABACCCBCCACAACCBCCBBACCCBACBAABBAAABCCBCCBBCAABBBBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABCCBABBBCBCBCBBACCABBBBCACBBACCABACCACBABCCBAAACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:7504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABACCABAACCCBABCCCABBACCCCBAABBBABAABACABAAAACCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABCCBABBBCBCBCBBACCABBBBCACBBACCABACCACBABCCBAAACBCC.exe" start= auto displayName= "UserDataSvc_AAABACCABAACCCBABCCCABBACCCCBAABBBABAABACABAAAACCCA"
  2⤵
  PID:7524
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABACCABAACCCBABCCCABBACCCCBAABBBABAABACABAAAACCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABCCBABBBCBCBCBBACCABBBBCACBBACCABACCACBABCCBAAACBCC.exe" start= auto displayName= "UserDataSvc_AAABACCABAACCCBABCCCABBACCCCBAABBBABAABACABAAAACCCA"
    3⤵
    - Launches sc.exe
    PID:7568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABACCABAACCCBABCCCABBACCCCBAABBBABAABACABAAAACCCA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7620
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABACCABAACCCBABCCCABBACCCCBAABBBABAABACABAAAACCCA"
    3⤵
    - Launches sc.exe
    PID:7700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACABCAAAABBCACBCCABABAACAACBABCCACAAACBCBCBBBBCABBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACABCAAAABBCACBCCABABAACAACBABCCACAAACBCBCBBBBCABBCA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABAABCBAACCABCCBBCAACCCBAAAAACAABAACCACBACBBCACBBBABCCCACCABABCCCBCBACCAAABBBCCABBCAAAAAACAABCBBBAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCCCBAAACAAACCCBCBCABCCAABCBABCCACCCCABCABCCBABBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABAABCBAACCABCCBBCAACCCBAAAAACAABAACCACBACBBCACBBBABCCCACCABABCCCBCBACCAAABBBCCABBCAAAAAACAABCBBBAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCCCBAAACAAACCCBCBCABCCAABCBABCCACCCCABCABCCBABBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:8096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAABACBCABBBAAACBCAAAABCACBAAAABBBACBACBABBACBAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCCCBAAACAAACCCBCBCABCCAABCBABCCACCCCABCABCCBABBAAA.exe" start= auto displayName= "UserDataSvc_AAAABACBCABBBAAACBCAAAABCACBAAAABBBACBACBABBACBAACA"
  2⤵
  PID:8172
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAAABACBCABBBAAACBCAAAABCACBAAAABBBACBACBABBACBAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCCCBAAACAAACCCBCBCABCCAABCBABCCACCCCABCABCCBABBAAA.exe" start= auto displayName= "UserDataSvc_AAAABACBCABBBAAACBCAAAABCACBAAAABBBACBACBABBACBAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:7252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAABACBCABBBAAACBCAAAABCACBAAAABBBACBACBABBACBAACA"
  2⤵
  PID:7304
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAAABACBCABBBAAACBCAAAABCACBAAAABBBACBACBABBACBAACA"
    3⤵
    PID:7392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCABAABBBBAACCCCABCAABBBCBCBBBACBAACBBABCCCCCBBBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCABAABBBBAACCCCABCAABBBCBCBBBACBAACBBABCCCCCBBBAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABBABBCCCCBCBBACCBBABCACBBACCAABCCAAACABCBCCABACABBCABBABABCCACABBABCBBBCAACBCCBABBCCCAACABAAACCBBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBCABCCCACCBCCBABABCCBBCACACBBBCBABAAAABCBCBBAAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7432
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABBABBCCCCBCBBACCBBABCACBBACCAABCCAAACABCBCCABACABBCABBABABCCACABBABCBBBCAACBCCBABBCCCAACABAAACCBBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBCABCCCACCBCCBABABCCBBCACACBBBCBABAAAABCBCBBAAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCAACCBBCCBBABCCACCCAABBABBAAACBACACCACBABBCAAACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBCABCCCACCBCCBABABCCBBCACACBBBCBABAAAABCBCBBAAACA.exe" start= auto displayName= "UserDataSvc_ACCAACCBBCCBBABCCACCCAABBABBAAACBACACCACBABBCAAACBC"
  2⤵
  PID:7756
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCAACCBBCCBBABCCACCCAABBABBAAACBACACCACBABBCAAACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBCABCCCACCBCCBABABCCBBCACACBBBCBABAAAABCBCBBAAACA.exe" start= auto displayName= "UserDataSvc_ACCAACCBBCCBBABCCACCCAABBABBAAACBACACCACBABBCAAACBC"
    3⤵
    PID:7552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCAACCBBCCBBABCCACCCAABBABBAAACBACACCACBABBCAAACBC"
  2⤵
  PID:4196
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCAACCBBCCBBABCCACCCAABBABBAAACBACACCACBABBCAAACBC"
    3⤵
    - Launches sc.exe
    PID:5436

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCABAABBBBAACCCCABCAABBBCBCBBBACBAACBBABCCCCCBBBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBCABAABBBBAACCCCABCAABBBCBCBBBACBAACBBABCCCCCBBBAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:6872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAACBBAABBACBBAABABCCCBCBABCBCAAABBBABAAACCBBAABABCAACACCBCBAABCCBBAAAACBABBAABABCACBBBABBBACCCABBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBBAABBACBBAABABCCCBCBABCBCAAABBBABAAACCBBAABABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7492
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAACBBAABBACBBAABABCCCBCBABCBCAAABBBABAAACCBBAABABCAACACCBCBAABCCBBAAAACBABBAABABCACBBBABBBACCCABBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBBAABBACBBAABABCCCBCBABCBCAAABBBABAAACCBBAABABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:7980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCCCAABBACBCABCCCBBCBBBBCACAABCBBCCACABCAAACACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBBAABBACBBAABABCCCBCBABCBCAAABBBABAAACCBBAABABCAA.exe" start= auto displayName= "UserDataSvc_CACCCCAABBACBCABCCCBBCBBBBCACAABCBBCCACABCAAACACACC"
  2⤵
  PID:8100
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACCCCAABBACBCABCCCBBCBBBBCACAABCBBCCACABCAAACACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBBAABBACBBAABABCCCBCBABCBCAAABBBABAAACCBBAABABCAA.exe" start= auto displayName= "UserDataSvc_CACCCCAABBACBCABCCCBBCBBBBCACAABCBBCCACABCAAACACACC"
    3⤵
    - Launches sc.exe
    PID:1144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCCCAABBACBCABCCCBBCBBBBCACAABCBBCCACABCAAACACACC"
  2⤵
  PID:7720
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACCCCAABBACBCABCCCBBCBBBBCACAABCBBCCACABCAAACACACC"
    3⤵
    - Launches sc.exe
    PID:7324

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBABBCABBCBCCCACBCBAAAAABBCCBCCAABABBAAACCBCAAABACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBABBCABBCBCCCACBCBAAAAABBCCBCCAABABBAAACCBCAAABACA.exe
1⤵
- Executes dropped EXE
PID:6900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBAABCBBBCACBAACCCACBABCBCACCBACBAABCACACBAABACBABBCCCCBACABACACAABCBBABAAAAABCAABCCCBBBAACABBABCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCABABCAAAABBAAACBAABCCBCBCCACCCCACCACCBBCAAAABBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7880
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBAABCBBBCACBAACCCACBABCBCACCBACBAABCACACBAABACBABBCCCCBACABACACAABCBBABAAAAABCAABCCCBBBAACABBABCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCABABCAAAABBAAACBAABCCBCBCCACCCCACCACCBBCAAAABBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:7852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACABBACCBBABABCCACBACCCACBCAABBBCABBAAABCBCABABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCABABCAAAABBAAACBAABCCBCBCCACCCCACCACCBBCAAAABBACBA.exe" start= auto displayName= "UserDataSvc_CACABBACCBBABABCCACBACCCACBCAABBBCABBAAABCBCABABBBC"
  2⤵
  PID:7212
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACABBACCBBABABCCACBACCCACBCAABBBCABBAAABCBCABABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCABABCAAAABBAAACBAABCCBCBCCACCCCACCACCBBCAAAABBACBA.exe" start= auto displayName= "UserDataSvc_CACABBACCBBABABCCACBACCCACBCAABBBCABBAAABCBCABABBBC"
    3⤵
    PID:7584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACABBACCBBABABCCACBACCCACBCAABBBCABBAAABCBCABABBBC"
  2⤵
  PID:7884
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACABBACCBBABABCCACBACCCACBCAABBBCABBAAABCBCABABBBC"
    3⤵
    PID:2500

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBABBCABBCBCCCACBCBAAAAABBCCBCCAABABBAAACCBCAAABACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBABBCABBCBCCCACBCBAAAAABBCCBCCAABABBAAACCBCAAABACA.exe
1⤵
- Executes dropped EXE
PID:7128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCABABACBBCBBBBCCAABACABACBAAACACCABBABBBABBABCBCACAAAACABACAAABACAACCCCABAACBABABCACCBCBBCBBBBCABBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCAAAACBAABABACABCBAACBCCACCBCCBCCBCCABABAABACCBACBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7476
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCABABACBBCBBBBCCAABACABACBAAACACCABBABBBABBABCBCACAAAACABACAAABACAACCCCABAACBABABCACCBCBBCBBBBCABBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCAAAACBAABABACABCBAACBCCACCBCCBCCBCCABABAABACCBACBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBBBCCCBBCCABCABBCAABABABCBABACBABABBABCABAAAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCAAAACBAABABACABCBAACBCCACCBCCBCCBCCABABAABACCBACBAA.exe" start= auto displayName= "UserDataSvc_BCCBBBCCCBBCCABCABBCAABABABCBABACBABABBABCABAAAAABB"
  2⤵
  PID:8208
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBBBCCCBBCCABCABBCAABABABCBABACBABABBABCABAAAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCAAAACBAABABACABCBAACBCCACCBCCBCCBCCABABAABACCBACBAA.exe" start= auto displayName= "UserDataSvc_BCCBBBCCCBBCCABCABBCAABABABCBABACBABABBABCABAAAAABB"
    3⤵
    - Launches sc.exe
    PID:8604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBBBCCCBBCCABCABBCAABABABCBABACBABABBABCABAAAAABB"
  2⤵
  PID:9004
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBBBCCCBBCCABCABBCAABABABCBABACBABABBABCABAAAAABB"
    3⤵
    PID:8428

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCAACCACBCAABBCBBAACBBBAACABCACBBCACABCCCBABACAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCAACCACBCAABBCBBAACBBBAACABCACBBCACABCCCBABACAAAC.exe
1⤵
- Executes dropped EXE
PID:5972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCAACBCBBBACBBCABCACCBAABAABCAABBBCCBCBABACBBCAAAAAABBBBBBABCAABCBBCCACBAAAABCBABACBBBCAABBBBCBBCCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCBCBABAAAABAABBBCCCBBABACCBCACBACBCBBABCACBABAABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCAACBCBBBACBBCABCACCBAABAABCAABBBCCBCBABACBBCAAAAAABBBBBBABCAABCBBCCACBAAAABCBABACBBBCAABBBBCBBCCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCBCBABAAAABAABBBCCCBBABACCBCACBACBCBBABCACBABAABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:8536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBACBCACBCCCCBBACABBAACCCACACAAAAAAAACABABCACBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCBCBABAAAABAABBBCCCBBABACCBCACBACBCBBABCACBABAABAAB.exe" start= auto displayName= "UserDataSvc_ACCBACBCACBCCCCBBACABBAACCCACACAAAAAAAACABABCACBCCB"
  2⤵
  PID:8992
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBACBCACBCCCCBBACABBAACCCACACAAAAAAAACABABCACBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCBCBABAAAABAABBBCCCBBABACCBCACBACBCBBABCACBABAABAAB.exe" start= auto displayName= "UserDataSvc_ACCBACBCACBCCCCBBACABBAACCCACACAAAAAAAACABABCACBCCB"
    3⤵
    - Launches sc.exe
    PID:2896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBACBCACBCCCCBBACABBAACCCACACAAAAAAAACABABCACBCCB"
  2⤵
  PID:8696
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBACBCACBCCCCBBACABBAACCCACACAAAAAAAACABABCACBCCB"
    3⤵
    PID:8284

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCAACCACBCAABBCBBAACBBBAACABCACBBCACABCCCBABACAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCAACCACBCAABBCBBAACBBBAACABCACBBCACABCCCBABACAAAC.exe
1⤵
- Executes dropped EXE
PID:4704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABAABCCACBAACCCACBACBBCAABCAACCBACCBCCCCACCABBAABABAAAACACCBCBBAAACCCBBCCCABCCBABBBCACABABCABBCBCBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCBBACAAAAAABACCACBBACCBCBABBACCCBCCAABBACAABCAABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABAABCCACBAACCCACBACBBCAABCAACCBACCBCCCCACCABBAABABAAAACACCBCBBAAACCCBBCCCABCCBABBBCACABABCABBCBCBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCBBACAAAAAABACCACBBACCBCBABBACCCBCCAABBACAABCAABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACAACBAACCBCCBACCBABCABBBABBCAAABBCBBCBCBABCCCBAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCBBACAAAAAABACCACBBACCBCBABBACCCBCCAABBACAABCAABAAA.exe" start= auto displayName= "UserDataSvc_ACAACBAACCBCCBACCBABCABBBABBCAAABBCBBCBCBABCCCBAAAA"
  2⤵
  PID:8656
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACAACBAACCBCCBACCBABCABBBABBCAAABBCBBCBCBABCCCBAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCBBACAAAAAABACCACBBACCBCBABBACCCBCCAABBACAABCAABAAA.exe" start= auto displayName= "UserDataSvc_ACAACBAACCBCCBACCBABCABBBABBCAAABBCBBCBCBABCCCBAAAA"
    3⤵
    PID:2472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACAACBAACCBCCBACCBABCABBBABBCAAABBCBBCBCBABCCCBAAAA"
  2⤵
  PID:8200
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACAACBAACCBCCBACCBABCABBBABBCAAABBCBBCBCBABCCCBAAAA"
    3⤵
    - Launches sc.exe
    PID:8772

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABAACABBBCAACBCAACCACACCACBBCBBBBACBACABABCCACCAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABAACABBBCAACBCAACCACACCACBBCBBBBACBACABABCCACCAAAC.exe
1⤵
- Executes dropped EXE
PID:6436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBBCCCCACBBCACABABACCBCBABCBACBAABBACABACCBAAACAABBBCABACCCBBAACCCCCCACCAACCACCCBCCCCBBAAAACBCAABACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBABBCCAABCBCBACCCCCCAAAABBBCABABBBACBCABBBACACACCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10156
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBBCCCCACBBCACABABACCBCBABCBACBAABBACABACCBAAACAABBBCABACCCBBAACCCCCCACCAACCACCCBCCCCBBAAAACBCAABACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBABBCCAABCBCBACCCCCCAAAABBBCABABBBACBCABBBACACACCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACABCCBBBBBAAACCBBBBBCBCBCAABACACCBAAAAABABCACCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBABBCCAABCBCBACCCCCCAAAABBBCABABBBACBCABBBACACACCBC.exe" start= auto displayName= "UserDataSvc_BBACABCCBBBBBAAACCBBBBBCBCBCAABACACCBAAAAABABCACCAB"
  2⤵
  PID:10740
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBACABCCBBBBBAAACCBBBBBCBCBCAABACACCBAAAAABABCACCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBABBCCAABCBCBACCCCCCAAAABBBCABABBBACBCABBBACACACCBC.exe" start= auto displayName= "UserDataSvc_BBACABCCBBBBBAAACCBBBBBCBCBCAABACACCBAAAAABABCACCAB"
    3⤵
    PID:6348

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABAACABBBCAACBCAACCACACCACBBCBBBBACBACABABCCACCAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABAACABBBCAACBCAACCACACCACBBCBBBBACBACABABCCACCAAAC.exe
1⤵
- Executes dropped EXE
PID:6352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAAAAACCCABCBABAACBCACACCCCCBAABBCBBBCBBCAABCBBABCCBBACABCAABCCBACAABCAABBACAACABACBAABBAABACBBCBCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABACACCCAACBBBABBBBBAABCBAABACAAAABCABCCCABACACCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAAAAACCCABCBABAACBCACACCCCCBAABBCBBBCBBCAABCBBABCCBBACABCAABCCBACAABCAABBACAACABACBAABBAABACBBCBCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABACACCCAACBBBABBBBBAABCBAABACAAAABCABCCCABACACCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCABABBBCBBACBCACBCCBABACABABBABBCBBABCCBBCABCBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABACACCCAACBBBABBBBBAABCBAABACAAAABCABCCCABACACCBCA.exe" start= auto displayName= "UserDataSvc_ACCABABBBCBBACBCACBCCBABACABABBABBCBBABCCBBCABCBBAC"
  2⤵
  PID:2320
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCABABBBCBBACBCACBCCBABACABABBABBCBBABCCBBCABCBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABACACCCAACBBBABBBBBAABCBAABACAAAABCABCCCABACACCBCA.exe" start= auto displayName= "UserDataSvc_ACCABABBBCBBACBCACBCCBABACABABBABBCBBABCCBBCABCBBAC"
    3⤵
    - Launches sc.exe
    PID:10164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCABABBBCBBACBCACBCCBABACABABBABBCBBABCCBBCABCBBAC"
  2⤵
  PID:10592
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCABABBBCBBACBCACBCCBABACABABBABBCBBABCCBBCABCBBAC"
    3⤵
    - Launches sc.exe
    PID:6264

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBAABBCACBCBCABABBBBBCCCACBBCABCCAABAACABABCBCCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBAABBCACBCBCABABBBBBCCCACBBCABCCAABAACABABCBCCABB.exe
1⤵
- Executes dropped EXE
PID:4860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBCBBBAACBBAACCBBBCBACBBBCBABCBBCACAABCBCBCAABABCBCABAACCABABCBACABCBCBCBBBBCBCCCBACBAAACBACCACACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBCBCCBBBBBCCAACACBCACABCCBACAAAACCAABBBBABCCACBABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBCBBBAACBBAACCBBBCBACBBBCBABCBBCACAABCBCBCAABABCBCABAACCABABCBACABCBCBCBBBBCBCCCBACBAAACBACCACACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBCBCCBBBBBCCAACACBCACABCCBACAAAACCAABBBBABCCACBABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11192

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBCCBCBABCCCBBBCCCAACBABBCBBCCCBCBBBCABACABCABBCBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBCCBCBABCCCBBBCCCAACBABBCBBCCCBCBBBCABACABCABBCBCBC.exe
1⤵
- Executes dropped EXE
PID:1852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBABCCABBCBCBCCCBABBABCABCBBCACBCCBBABCCAACCBAAACCACBAAACBCBCACCABABBCACCAABBCABCACCACBBACCACABBAABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABBCABCBACCACABAAAACBAAABCCBCACCCAAABACACCAACBBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBABCCABBCBCBCCCBABBABCABCBBCACBCCBBABCCAACCBAAACCACBAAACBCBCACCABABBCACCAABBCABCACCACBBACCACABBAABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABBCABCBACCACABAAAACBAAABCCBCACCCAAABACACCAACBBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBBAABABCABACACABAAABBBBABACAACACBCCCCCABACCABCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABBCABCBACCACABAAAACBAAABCCBCACCCAAABACACCAACBBCCCC.exe" start= auto displayName= "UserDataSvc_ACBBAABABCABACACABAAABBBBABACAACACBCCCCCABACCABCCCB"
  2⤵
  PID:8764
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBBAABABCABACACABAAABBBBABACAACACBCCCCCABACCABCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABBCABCBACCACABAAAACBAAABCCBCACCCAAABACACCAACBBCCCC.exe" start= auto displayName= "UserDataSvc_ACBBAABABCABACACABAAABBBBABACAACACBCCCCCABACCABCCCB"
    3⤵
    - Launches sc.exe
    PID:5708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBBAABABCABACACABAAABBBBABACAACACBCCCCCABACCABCCCB"
  2⤵
  PID:1144
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBBAABABCABACACABAAABBBBABACAACACBCCCCCABACCABCCCB"
    3⤵
    - Launches sc.exe
    PID:3960

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBCCBCBABCCCBBBCCCAACBABBCBBCCCBCBBBCABACABCABBCBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBCCBCBABCCCBBBCCCAACBABBCBBCCCBCBBBCABACABCABBCBCBC.exe
1⤵
- Executes dropped EXE
PID:5028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACBBBAACCBBACACBBCACAACBABBCABABAAAACACABABCABAAACBBBACBBBCBCACACBBCAABCAABBACCCBCABCCBCAABCABBACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAAAACCBCBCBBBCBBABBCBBBAACBBABBACAABBBBACCABBCACBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACBBBAACCBBACACBBCACAACBABBCABABAAAACACABABCABAAACBBBACBBBCBCACACBBCAABCAABBACCCBCABCCBCAABCABBACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAAAACCBCBCBBBCBBABBCBBBAACBBABBACAABBBBACCABBCACBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABBCCACBAABACBAACCACAAAACAABBABBBCBBBBACBBAABCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAAAACCBCBCBBBCBBABBCBBBAACBBABBACAABBBBACCABBCACBAB.exe" start= auto displayName= "UserDataSvc_CBABBCCACBAABACBAACCACAAAACAABBABBBCBBBBACBBAABCAAA"
  2⤵
  PID:8412
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABBCCACBAABACBAACCACAAAACAABBABBBCBBBBACBBAABCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAAAACCBCBCBBBCBBABBCBBBAACBBABBACAABBBBACCABBCACBAB.exe" start= auto displayName= "UserDataSvc_CBABBCCACBAABACBAACCACAAAACAABBABBBCBBBBACBBAABCAAA"
    3⤵
    PID:8772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABBCCACBAABACBAACCACAAAACAABBABBBCBBBBACBBAABCAAA"
  2⤵
  PID:5096
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7948
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABBCCACBAABACBAACCACAAAACAABBABBBCBBBBACBBAABCAAA"
    3⤵
    PID:3008

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCCCBABABABABCABCCBCBBACCCBAABBCACCABBABCAABBABCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCCCBABABABABCABCCBCBBACCCBAABBCACCABBABCAABBABCACA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCACCCAACCBCCCBBBCABBCABCBCAAAACCACBCBCCBABCBBBBCCBACBBAABAACABCCABABABBBBBABABCBABAABBCABAACCBBBABBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCABBBCBACAABACBBACCBCABACCBBACACCACBCCABCBBABCBAAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCACCCAACCBCCCBBBCABBCABCBCAAAACCACBCBCCBABCBBBBCCBACBBAABAACABCCABABABBBBBABABCBABAABBCABAACCBBBABBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCABBBCBACAABACBBACCBCABACCBBACACCACBCCABCBBABCBAAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABCAABABBBABABBAACBBAACBCCACCCBCAAABCCBBBCCBBCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCABBBCBACAABACBBACCBCABACCBBACACCACBCCABCBBABCBAAACA.exe" start= auto displayName= "UserDataSvc_CAABCAABABBBABABBAACBBAACBCCACCCBCAAABCCBBBCCBBCBCC"
  2⤵
  PID:796
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABCAABABBBABABBAACBBAACBCCACCCBCAAABCCBBBCCBBCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCABBBCBACAABACBBACCBCABACCBBACACCACBCCABCBBABCBAAACA.exe" start= auto displayName= "UserDataSvc_CAABCAABABBBABABBAACBBAACBCCACCCBCAAABCCBBBCCBBCBCC"
    3⤵
    PID:7900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABCAABABBBABABBAACBBAACBCCACCCBCAAABCCBBBCCBBCBCC"
  2⤵
  PID:7748
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABCAABABBBABABBAACBBAACBCCACCCBCAAABCCBBBCCBBCBCC"
    3⤵
    PID:2084

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCCCBABABABABCABCCBCBBACCCBAABBCACCABBABCAABBABCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCCCBABABABABCABCCBCBBACCCBAABBCACCABBABCAABBABCACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAACCBBBCCAABBCCBABBBBCCCBACACBCCBCACABCBBCBCCACCCBBBAABBAAABAACCCBACCACCCACACCACABBBCCBBACBBCCACACCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCBBBCCAABBCCBABBBBCCCBACACBCCBCACABCBBCBCCACCCBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAACCBBBCCAABBCCBABBBBCCCBACACBCCBCACABCBBCBCCACCCBBBAABBAAABAACCCBACCACCCACACCACABBBCCBBACBBCCACACCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCBBBCCAABBCCBABBBBCCCBACACBCCBCACABCBBCBCCACCCBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCABBBBCAACAABACACCBBACCBCAABAACABAABACCACCAAAAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCBBBCCAABBCCBABBBBCCCBACACBCCBCACABCBBCBCCACCCBBBA.exe" start= auto displayName= "UserDataSvc_BBCABBBBCAACAABACACCBBACCBCAABAACABAABACCACCAAAAACC"
  2⤵
  PID:1792
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCABBBBCAACAABACACCBBACCBCAABAACABAABACCACCAAAAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCBBBCCAABBCCBABBBBCCCBACACBCCBCACABCBBCBCCACCCBBBA.exe" start= auto displayName= "UserDataSvc_BBCABBBBCAACAABACACCBBACCBCAABAACABAABACCACCAAAAACC"
    3⤵
    - Launches sc.exe
    PID:8048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCABBBBCAACAABACACCBBACCBCAABAACABAABACCACCAAAAACC"
  2⤵
  PID:7208
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCABBBBCAACAABACACCBBACCBCAABAACABAABACCACCAAAAACC"
    3⤵
    - Launches sc.exe
    PID:7248

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBAACABABCAAAABCCBCCBBACCBBBCBCBAACABBCCACCBBBCBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBAACABABCAAAABCCBCCBBACCBBBCBCBAACABBCCACCBBBCBBCB.exe
1⤵
- Executes dropped EXE
PID:7224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBAACBCBAABCBACBBABCCCBAABBACBAABBCCBBBBAACBCCACBCABBCCCBCBCACBCAAAAABBBABBCABAAABACACBAAAABACAACAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABACBCBCABCAABBABCBCCAACBCBBACCCACCBBABBBCCABBBCCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBAACBCBAABCBACBBABCCCBAABBACBAABBCCBBBBAACBCCACBCABBCCCBCBCACBCAAAAABBBABBCABAAABACACBAAAABACAACAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABACBCBCABCAABBABCBCCAACBCBBACCCACCBBABBBCCABBBCCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:2284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBABACABACCAACAABCAAACBABCACCCCCCCACCCCCBBBAABBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABACBCBCABCAABBABCBCCAACBCBBACCCACCBBABBBCCABBBCCBCB.exe" start= auto displayName= "UserDataSvc_BBBABACABACCAACAABCAAACBABCACCCCCCCACCCCCBBBAABBBCA"
  2⤵
  PID:8476
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBABACABACCAACAABCAAACBABCACCCCCCCACCCCCBBBAABBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABACBCBCABCAABBABCBCCAACBCBBACCCACCBBABBBCCABBBCCBCB.exe" start= auto displayName= "UserDataSvc_BBBABACABACCAACAABCAAACBABCACCCCCCCACCCCCBBBAABBBCA"
    3⤵
    - Launches sc.exe
    PID:8920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBABACABACCAACAABCAAACBABCACCCCCCCACCCCCBBBAABBBCA"
  2⤵
  PID:8452
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBABACABACCAACAABCAAACBABCACCCCCCCACCCCCBBBAABBBCA"
    3⤵
    PID:8672

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABCCCAACACACBBBCACCBBACBACACCCABCBBACCCBAACCABCBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABCCCAACACACBBBCACCBBACBACACCCABCBBACCCBAACCABCBBBA.exe
1⤵
- Executes dropped EXE
PID:7336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABAACCCAACACBBBCCAABCCCCAACACBAABBABAABCBCCBCBCBBCCCCCABCCCABBCABBACABBCAABBCCAAAAAACACACAAABBCBCBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABCBCACAAAACACBABBBBBBCABAACBCCCCCBBBBACCBCBCACBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABAACCCAACACBBBCCAABCCCCAACACBAABBABAABCBCCBCBCBBCCCCCABCCCABBCABBACABBCAABBCCAAAAAACACACAAABBCBCBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABCBCACAAAACACBABBBBBBCABAACBCCCCCBBBBACCBCBCACBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAAAACBCACCBBBBAACCCABBCCCABCACACBCBCBBBCACAACBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABCBCACAAAACACBABBBBBBCABAACBCCCCCBBBBACCBCBCACBAABB.exe" start= auto displayName= "UserDataSvc_BBAAAACBCACCBBBBAACCCABBCCCABCACACBCBCBBBCACAACBBCA"
  2⤵
  PID:9036
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAAAACBCACCBBBBAACCCABBCCCABCACACBCBCBBBCACAACBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABCBCACAAAACACBABBBBBBCABAACBCCCCCBBBBACCBCBCACBAABB.exe" start= auto displayName= "UserDataSvc_BBAAAACBCACCBBBBAACCCABBCCCABCACACBCBCBBBCACAACBBCA"
    3⤵
    - Launches sc.exe
    PID:8464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAAAACBCACCBBBBAACCCABBCCCABCACACBCBCBBBCACAACBBCA"
  2⤵
  PID:8732
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAAAACBCACCBBBBAACCCABBCCCABCACACBCBCBBBCACAACBBCA"
    3⤵
    PID:8484

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABCCBABBBCBCBCBBACCABBBBCACBBACCABACCACBABCCBAAACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABCCBABBBCBCBCBBACCABBBBCACBBACCABACCACBABCCBAAACBCC.exe
1⤵
- Executes dropped EXE
PID:7888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABBACCAACBCBABBABCABACBACABCABBCBACCBBBBBACBBCCABBCBABBBBACBCCBABACBCBCBAABBBCABCCACABAAABBCCBCCAAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBABABABAACCCCCBBBBBAAAABCAABACBBACCCAAACCCCACAABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8796
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABBACCAACBCBABBABCABACBACABCABBCBACCBBBBBACBBCCABBCBABBBBACBCCBABACBCBCBAABBBCABCCACABAAABBCCBCCAAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBABABABAACCCCCBBBBBAAAABCAABACBBACCCAAACCCCACAABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCAAACCBCBABCCCABABACBBBAAACAABBCACCCACACCACCABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBABABABAACCCCCBBBBBAAAABCAABACBBACCCAAACCCCACAABBA.exe" start= auto displayName= "UserDataSvc_ABCAAACCBCBABCCCABABACBBBAAACAABBCACCCACACCACCABBBC"
  2⤵
  PID:1272
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCAAACCBCBABCCCABABACBBBAAACAABBCACCCACACCACCABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBABABABAACCCCCBBBBBAAAABCAABACBBACCCAAACCCCACAABBA.exe" start= auto displayName= "UserDataSvc_ABCAAACCBCBABCCCABABACBBBAAACAABBCACCCACACCACCABBBC"
    3⤵
    - Launches sc.exe
    PID:9456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCAAACCBCBABCCCABABACBBBAAACAABBCACCCACACCACCABBBC"
  2⤵
  PID:9684
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCAAACCBCBABCCCABABACBBBAAACAABBCACCCACACCACCABBBC"
    3⤵
    PID:9852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAABABCBBBBABBAAAAAABCAACCABCCABCBBABCCBCBCBBCAABCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAABABCBBBBABBAAAAAABCAACCABCCABCBBABCCBCBCBBCAABCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:8124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCAACCAABBAACCCAACBCAABBBCAABCACCBBACBBACABACBCCCCCCBCCABAACABABACCBABCBAAABCCBCAAABAACAACBCBABBAABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABACBBCAAACBCCCCACAACCACBCCBCAACCCAACAAACBCACCCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4232
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCAACCAABBAACCCAACBCAABBBCAABCACCBBACBBACABACBCCCCCCBCCABAACABABACCBABCBAAABCCBCAAABAACAACBCBABBAABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABACBBCAAACBCCCCACAACCACBCCBCAACCCAACAAACBCACCCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:9960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACACAACBCAABBCAACBCBCACCCCCBBACCABACCBCBABBBABBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABACBBCAAACBCCCCACAACCACBCCBCAACCCAACAAACBCACCCBCB.exe" start= auto displayName= "UserDataSvc_CACACAACBCAABBCAACBCBCACCCCCBBACCABACCBCBABBBABBAAA"
  2⤵
  PID:6156
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACACAACBCAABBCAACBCBCACCCCCBBACCABACCBCBABBBABBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABACBBCAAACBCCCCACAACCACBCCBCAACCCAACAAACBCACCCBCB.exe" start= auto displayName= "UserDataSvc_CACACAACBCAABBCAACBCBCACCCCCBBACCABACCBCBABBBABBAAA"
    3⤵
    PID:11192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACACAACBCAABBCAACBCBCACCCCCBBACCABACCBCBABBBABBAAA"
  2⤵
  PID:6224
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACACAACBCAABBCAACBCBCACCCCCBBACCABACCBCBABBBABBAAA"
    3⤵
    PID:12224

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAABABCBBBBABBAAAAAABCAACCABCCABCBBABCCBCBCBBCAABCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAABABCBBBBABBAAAAAABCAACCABCCABCBBABCCBCBCBBCAABCAA.exe
1⤵
- Executes dropped EXE
PID:8160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBABCCBAACAACBBCCACCABBCAAACCCBCBCBABABABCBACAABCAABAACBCBCABBCACCBABCAACCACACBCACCAAABBAABBBCCCAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACAACBCCBCAACABAABAABACBBACAABCCAABAAABCCAACABCCCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBABCCBAACAACBBCCACCABBCAAACCCBCBCBABABABCBACAABCAABAACBCBCABBCACCBABCAACCACACBCACCAAABBAABBBCCCAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACAACBCCBCAACABAABAABACBBACAABCCAABAAABCCAACABCCCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:9992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBACBCABCBCBABBBACCABAACBBAACCABAAACCBACCCABBBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACAACBCCBCAACABAABAABACBBACAABCCAABAAABCCAACABCCCBAA.exe" start= auto displayName= "UserDataSvc_BCCBACBCABCBCBABBBACCABAACBBAACCABAAACCBACCCABBBACB"
  2⤵
  PID:9520
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBACBCABCBCBABBBACCABAACBBAACCABAAACCBACCCABBBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACAACBCCBCAACABAABAABACBBACAABCCAABAAABCCAACABCCCBAA.exe" start= auto displayName= "UserDataSvc_BCCBACBCABCBCBABBBACCABAACBBAACCABAAACCBACCCABBBACB"
    3⤵
    PID:10452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBACBCABCBCBABBBACCABAACBBAACCABAAACCBACCCABBBACB"
  2⤵
  PID:9964
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBACBCABCBCBABBBACCABAACBBAACCABAAACCBACCCABBBACB"
    3⤵
    PID:11652

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCCCBAAACAAACCCBCBCABCCAABCBABCCACCCCABCABCCBABBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCCCBAAACAAACCCBCBCABCCAABCBABCCACCCCABCABCCBABBAAA.exe
1⤵
- Executes dropped EXE
PID:7204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCBACAACACCABCCBBCBAABCCACCACBCBBACABCCCCBABBCCCBABBBACBBAACCCBACCABBACCCABCBBBBCCCACCBACCBACACCBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAACBBAACCABACBAABBAABBBABCAAAABCBAABCBCACCCABAACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCBACAACACCABCCBBCBAABCCACCACBCBBACABCCCCBABBCCCBABBBACBBAACCCBACCABBACCCABCBBBBCCCACCBACCBACACCBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAACBBAACCABACBAABBAABBBABCAAAABCBAABCBCACCCABAACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACBCCBBBBBABCBBBBABCCACBCCAABCCBCCBABBCACACBACABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAACBBAACCABACBAABBAABBBABCAAAABCBAABCBCACCCABAACBC.exe" start= auto displayName= "UserDataSvc_AACBCCBBBBBABCBBBBABCCACBCCAABCCBCCBABBCACACBACABCB"
  2⤵
  PID:11480
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACBCCBBBBBABCBBBBABCCACBCCAABCCBCCBABBCACACBACABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAACBBAACCABACBAABBAABBBABCAAAABCBAABCBCACCCABAACBC.exe" start= auto displayName= "UserDataSvc_AACBCCBBBBBABCBBBBABCCACBCCAABCCBCCBABBCACACBACABCB"
    3⤵
    PID:10764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACBCCBBBBBABCBBBBABCCACBCCAABCCBCCBABBCACACBACABCB"
  2⤵
  PID:11800
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACBCCBBBBBABCBBBBABCCACBCCAABCCBCCBABBCACACBACABCB"
    3⤵
    - Launches sc.exe
    PID:13772

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCCCBAAACAAACCCBCBCABCCAABCBABCCACCCCABCABCCBABBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCCCBAAACAAACCCBCBCABCCAABCBABCCACCCCABCABCCBABBAAA.exe
1⤵
- Executes dropped EXE
PID:7180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCBACAACACCABCCBBCBAABCCACCACBCBBACABCCCCBABBCCCBABBBACBBAACCCBACCABBACCCABCBBBBCCCACCBACCBACACCBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCACAAAACBCCBACCABCCACCABACCBACCBACABCACBAABBACACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCBACAACACCABCCBBCBAABCCACCACBCBBACABCCCCBABBCCCBABBBACBBAACCCBACCABBACCCABCBBBBCCCACCBACCBACACCBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCACAAAACBCCBACCABCCACCABACCBACCBACABCACBAABBACACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:7152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACBACCCAABCBCACCAAACBBCAABCABBABBBCAABAABCBACBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCACAAAACBCCBACCABCCACCABACCBACCBACABCACBAABBACACAA.exe" start= auto displayName= "UserDataSvc_ABACBACCCAABCBCACCAAACBBCAABCABBABBBCAABAABCBACBCAB"
  2⤵
  PID:11300
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACBACCCAABCBCACCAAACBBCAABCABBABBBCAABAABCBACBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCACAAAACBCCBACCABCCACCABACCBACCBACABCACBAABBACACAA.exe" start= auto displayName= "UserDataSvc_ABACBACCCAABCBCACCAAACBBCAABCABBABBBCAABAABCBACBCAB"
    3⤵
    - Launches sc.exe
    PID:7256

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCBBBCCAABBCCBABBBBCCCBACACBCCBCACABCBBCBCCACCCBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCBBBCCAABBCCBABBBBCCCBACACBCCBCACABCBBCBCCACCCBBBA.exe
1⤵
PID:3552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBABBBAAABABAAACBCAAAAACACBCCBCCBBCACBAAAABCBBACCBCABBCACAAACBABAACBCCAAABBACCBBBCABCAAACBCACBCBAAAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBACBCCCCAAAABABBBAABCBBCCCCBBCBACCCAABCBCABCAAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBABBBAAABABAAACBCAAAAACACBCCBCCBBCACBAAAABCBBACCBCABBCACAAACBABAACBCCAAABBACCBBBCABCAAACBCACBCBAAAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBACBCCCCAAAABABBBAABCBBCCCCBBCBACCCAABCBCABCAAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:3404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBACBACBACABACCCBACCAABCAACAABBBACAABCCCABABCABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBACBCCCCAAAABABBBAABCBBCCCCBBCBACCCAABCBCABCAAABAB.exe" start= auto displayName= "UserDataSvc_CCBBACBACBACABACCCBACCAABCAACAABBBACAABCCCABABCABAB"
  2⤵
  PID:2708
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBACBACBACABACCCBACCAABCAACAABBBACAABCCCABABCABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBACBCCCCAAAABABBBAABCBBCCCCBBCBACCCAABCBCABCAAABAB.exe" start= auto displayName= "UserDataSvc_CCBBACBACBACABACCCBACCAABCAACAABBBACAABCCCABABCABAB"
    3⤵
    - Launches sc.exe
    PID:8880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBACBACBACABACCCBACCAABCAACAABBBACAABCCCABABCABAB"
  2⤵
  PID:8472
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBACBACBACABACCCBACCAABCAACAABBBACAABCCCABABCABAB"
    3⤵
    - Launches sc.exe
    PID:4592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBBAABBACBBAABABCCCBCBABCBCAAABBBABAAACCBBAABABCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBBAABBACBBAABABCCCBCBABCBCAAABBBABAAACCBBAABABCAA.exe
1⤵
PID:7616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAACCAACBCCCCACABAACCCCAAAAABCBBBACBABBBAAAACACBACCAACACBBCACCBAABCBABABCACAABABAAAACAAABCABBABBCCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACCAACBCCCCACABAACCCCAAAAABCBBBACBABBBAAAACACBACCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAACCAACBCCCCACABAACCCCAAAAABCBBBACBABBBAAAACACBACCAACACBBCACCBAABCBABABCACAABABAAAACAAABCABBABBCCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACCAACBCCCCACABAACCCCAAAAABCBBBACBABBBAAAACACBACCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBABAABABCCABABABCBABCCACBACBCAAABCACBCACCBCCBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACCAACBCCCCACABAACCCCAAAAABCBBBACBABBBAAAACACBACCAA.exe" start= auto displayName= "UserDataSvc_BCCBABAABABCCABABABCBABCCACBACBCAAABCACBCACCBCCBABB"
  2⤵
  PID:8512
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBABAABABCCABABABCBABCCACBACBCAAABCACBCACCBCCBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACCAACBCCCCACABAACCCCAAAAABCBBBACBABBBAAAACACBACCAA.exe" start= auto displayName= "UserDataSvc_BCCBABAABABCCABABABCBABCCACBACBCAAABCACBCACCBCCBABB"
    3⤵
    - Launches sc.exe
    PID:9384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBABAABABCCABABABCBABCCACBACBCAAABCACBCACCBCCBABB"
  2⤵
  PID:9524
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBABAABABCCABABABCBABCCACBACBCAAABCACBCACCBCCBABB"
    3⤵
    PID:9740

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCABABCAAAABBAAACBAABCCBCBCCACCCCACCACCBBCAAAABBACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCABABCAAAABBAAACBAABCCBCBCCACCCCACCACCBBCAAAABBACBA.exe
1⤵
PID:4996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBABAACBAABCCABCACBCCCBACBCCBCBCABBAABBBBBABCCBBCBBACCBBAAABBAABBBABBCCAABACAAAABCABAACABBBCCAABBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACABCAABABBCBBBACABBCABCCCACBCCABCBAAAABCABCCCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBABAACBAABCCABCACBCCCBACBCCBCBCABBAABBBBBABCCBBCBBACCBBAAABBAABBBABBCCAABACAAAABCABAACABBBCCAABBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACABCAABABBCBBBACABBCABCCCACBCCABCBAAAABCABCCCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBAACAABCABBCABBBCABCCACBBACBAABBAAAAAAAACACCBBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACABCAABABBCBBBACABBCABCCCACBCCABCBAAAABCABCCCBBBB.exe" start= auto displayName= "UserDataSvc_CCBAACAABCABBCABBBCABCCACBBACBAABBAAAAAAAACACCBBCCA"
  2⤵
  PID:4240
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBAACAABCABBCABBBCABCCACBBACBAABBAAAAAAAACACCBBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACABCAABABBCBBBACABBCABCCCACBCCABCBAAAABCABCCCBBBB.exe" start= auto displayName= "UserDataSvc_CCBAACAABCABBCABBBCABCCACBBACBAABBAAAAAAAACACCBBCCA"
    3⤵
    - Launches sc.exe
    PID:2052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBAACAABCABBCABBBCABCCACBBACBAABBAAAAAAAACACCBBCCA"
  2⤵
  PID:6696
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBAACAABCABBCABBBCABCCACBBACBAABBAAAAAAAACACCBBCCA"
    3⤵
    - Launches sc.exe
    PID:2052

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBCABCCCACCBCCBABABCCBBCACACBBBCBABAAAABCBCBBAAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBCABCCCACCBCCBABABCCBBCACACBBBCBABAAAABCBCBBAAACA.exe
1⤵
PID:7584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBAABCBBBCCCAABAACCACAAAABCAACCBACAAAAABAABCBAACCACCACAACBCBCCCBAABBAACCACABBABCBBCACBAAABACBAACCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBCBABCABABAAABABBBCCCBABCABBABACABBBBAAACCBCCBAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9932
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBAABCBBBCCCAABAACCACAAAABCAACCBACAAAAABAABCBAACCACCACAACBCBCCCBAABBAACCACABBABCBBCACBAAABACBAACCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBCBABCABABAAABABBBCCCBABCABBABACABBBBAAACCBCCBAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBACCAACABCABCCCBBACCBACAAAACBAABACCCABCCABCCCCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBCBABCABABAAABABBBCCCBABCABBABACABBBBAAACCBCCBAACA.exe" start= auto displayName= "UserDataSvc_CCBACCAACABCABCCCBBACCBACAAAACBAABACCCABCCABCCCCCAB"
  2⤵
  PID:9452
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBACCAACABCABCCCBBACCBACAAAACBAABACCCABCCABCCCCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBCBABCABABAAABABBBCCCBABCABBABACABBBBAAACCBCCBAACA.exe" start= auto displayName= "UserDataSvc_CCBACCAACABCABCCCBBACCBACAAAACBAABACCCABCCABCCCCCAB"
    3⤵
    PID:9348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBACCAACABCABCCCBBACCBACAAAACBAABACCCABCCABCCCCCAB"
  2⤵
  PID:9956
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBACCAACABCABCCCBBACCBACAAAACBAABACCCABCCABCCCCCAB"
    3⤵
    - Launches sc.exe
    PID:10616

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCABBBCBACAABACBBACCBCABACCBBACACCACBCCABCBBABCBAAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCABBBCBACAABACBBACCBCABACCBBACACCACBCCABCBBABCBAAACA.exe
1⤵
PID:8068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBABAACBAABCCABCACBCCCBACBCCBCBCABBAABBBBBABCCBBCBBACCBBAAABBAABBBABBCCAABACAAAABCABAACABBBCCAABBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACABCAABABBCBBBACABBCABCCCACBCCABCBAAAABCABCCCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBABAACBAABCCABCACBCCCBACBCCBCBCABBAABBBBBABCCBBCBBACCBBAAABBAABBBABBCCAABACAAAABCABAACABBBCCAABBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACABCAABABBCBBBACABBCABCCCACBCCABCBAAAABCABCCCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACBABACBBCAAACBCCCCACAACCACBCCBCAACCCAACAAACBCACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACABCAABABBCBBBACABBCABCCCACBCCABCBAAAABCABCCCBBBB.exe" start= auto displayName= "UserDataSvc_BBACBABACBBCAAACBCCCCACAACCACBCCBCAACCCAACAAACBCACC"
  2⤵
  PID:9368
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBACBABACBBCAAACBCCCCACAACCACBCCBCAACCCAACAAACBCACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACABCAABABBCBBBACABBCABCCCACBCCABCBAAAABCABCCCBBBB.exe" start= auto displayName= "UserDataSvc_BBACBABACBBCAAACBCCCCACAACCACBCCBCAACCCAACAAACBCACC"
    3⤵
    PID:10076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACBABACBBCAAACBCCCCACAACCACBCCBCAACCCAACAAACBCACC"
  2⤵
  PID:5920
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBACBABACBBCAAACBCCCCACAACCACBCCBCAACCCAACAAACBCACC"
    3⤵
    PID:11228

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBCABCCCACCBCCBABABCCBBCACACBBBCBABAAAABCBCBBAAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBCABCCCACCBCCBABABCCBBCACACBBBCBABAAAABCBCBBAAACA.exe
1⤵
PID:7484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBABBAABBCACBABBAAAACABBCABBCACABBCBABBACABBBBBCAACBAACCAABBACAACBCCCBBBCABCACABCCBACABCBABAABAAAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACCCACBCBCCAABCBBCACCAACCBCBACABBCBABCCCABBABACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6044
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBABBAABBCACBABBAAAACABBCABBCACABBCBABBACABBBBBCAACBAACCAABBACAACBCCCBBBCABCACABCCBACABCBABAABAAAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACCCACBCBCCAABCBBCACCAACCBCBACABBCBABCCCABBABACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABCACBCBAABBBBACABABBBCCBBBCCCCBAABAACCBABAACBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACCCACBCBCCAABCBBCACCAACCBCBACABBCBABCCCABBABACAC.exe" start= auto displayName= "UserDataSvc_BCABCACBCBAABBBBACABABBBCCBBBCCCCBAABAACCBABAACBCAB"
  2⤵
  PID:10456
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABCACBCBAABBBBACABABBBCCBBBCCCCBAABAACCBABAACBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACCCACBCBCCAABCBBCACCAACCBCBACABBCBABCCCABBABACAC.exe" start= auto displayName= "UserDataSvc_BCABCACBCBAABBBBACABABBBCCBBBCCCCBAABAACCBABAACBCAB"
    3⤵
    - Launches sc.exe
    PID:10124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABCACBCBAABBBBACABABBBCCBBBCCCCBAABAACCBABAACBCAB"
  2⤵
  PID:3556
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABCACBCBAABBBBACABABBBCCBBBCCCCBAABAACCBABAACBCAB"
    3⤵
    - Launches sc.exe
    PID:12100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCBBBCCAABBCCBABBBBCCCBACACBCCBCACABCBBCBCCACCCBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCBBBCCAABBCCBABBBBCCCBACACBCCBCACABCBBCBCCACCCBBBA.exe
1⤵
PID:7232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBACCCBBABACCBACBBCBABCBACCCCCABCBCBAACCACBABBCABCAACBBABABCCABCACAABCABCCABBCBABACABAAACBABCBACABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBBAAAACAABACCCABACACCCBCBABBBACCABAABACCABAABABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBACCCBBABACCBACBBCBABCBACCCCCABCBCBAACCACBABBCABCAACBBABABCCABCACAABCABCCABBCBABACABAAACBABCBACABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBBAAAACAABACCCABACACCCBCBABBBACCABAABACCABAABABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBBABCACBCBBACACCBCACCBBABCCAABCCAAACBBACABBAAACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBBAAAACAABACCCABACACCCBCBABBBACCABAABACCABAABABAAB.exe" start= auto displayName= "UserDataSvc_CBBBABCACBCBBACACCBCACCBBABCCAABCCAAACBBACABBAAACAB"
  2⤵
  PID:10908
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBBABCACBCBBACACCBCACCBBABCCAABCCAAACBBACABBAAACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBBAAAACAABACCCABACACCCBCBABBBACCABAABACCABAABABAAB.exe" start= auto displayName= "UserDataSvc_CBBBABCACBCBBACACCBCACCBBABCCAABCCAAACBBACABBAAACAB"
    3⤵
    - Launches sc.exe
    PID:10056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBBABCACBCBBACACCBCACCBBABCCAABCCAAACBBACABBAAACAB"
  2⤵
  PID:11616
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBBABCACBCBBACACCBCACCBBABCCAABCCAAACBBACABBAAACAB"
    3⤵
    PID:6740

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBBAABBACBBAABABCCCBCBABCBCAAABBBABAAACCBBAABABCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBBAABBACBBAABABCCCBCBABCBCAAABBBABAAACCBBAABABCAA.exe
1⤵
PID:3272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACABBBBBCACBAAAACBCBCBBABAAACCABABBCBBAAACCBBBAACCCBBBACBAACABBBBABACBACACACBCBAABCAACACABBCCBACCCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCAAAACAAABBBAACCBABAACAABCBBCBAABACBCCCBBCBBBCBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACABBBBBCACBAAAACBCBCBBABAAACCABABBCBBAAACCBBBAACCCBBBACBAACABBBBABACBACACACBCBAABCAACACABBCCBACCCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCAAAACAAABBBAACCBABAACAABCBBCBAABACBCCCBBCBBBCBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:8700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABCCCAAACBCACABBBBACCBAABBACCCAACBABBCCBCBCAABCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCAAAACAAABBBAACCBABAACAABCBBCBAABACBCCCBBCBBBCBABA.exe" start= auto displayName= "UserDataSvc_CBABCCCAAACBCACABBBBACCBAABBACCCAACBABBCCBCBCAABCAA"
  2⤵
  PID:9336
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABCCCAAACBCACABBBBACCBAABBACCCAACBABBCCBCBCAABCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCAAAACAAABBBAACCBABAACAABCBBCBAABACBCCCBBCBBBCBABA.exe" start= auto displayName= "UserDataSvc_CBABCCCAAACBCACABBBBACCBAABBACCCAACBABBCCBCBCAABCAA"
    3⤵
    PID:1932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABCCCAAACBCACABBBBACCBAABBACCCAACBABBCCBCBCAABCAA"
  2⤵
  PID:4976
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABCCCAAACBCACABBBBACCBAABBACCCAACBABBCCBCBCAABCAA"
    3⤵
    PID:13288

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCABABCAAAABBAAACBAABCCBCBCCACCCCACCACCBBCAAAABBACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCABABCAAAABBAAACBAABCCBCBCCACCCCACCACCBBCAAAABBACBA.exe
1⤵
PID:7200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABCBCAAABCCCCBCCAABBABCBCCCCBCBBCACAACACBCABACCABCABBBBBCBABBBAABAABACCCBABABABBACBBBABACBCAABBCABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBBBBCCAACBACCAAABCAACCAAACCACBBCCACBAACCBABCBCBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABCBCAAABCCCCBCCAABBABCBCCCCBCBBCACAACACBCABACCABCABBBBBCBABBBAABAABACCCBABABABBACBBBABACBCAABBCABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBBBBCCAACBACCAAABCAACCAAACCACBBCCACBAACCBABCBCBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBACCAABACBAACCCCCCCACCBABCAABBCBCAABCACBAAACBCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBBBBCCAACBACCAAABCAACCAAACCACBBCCACBAACCBABCBCBCAC.exe" start= auto displayName= "UserDataSvc_CCBACCAABACBAACCCCCCCACCBABCAABBCBCAABCACBAAACBCCBA"
  2⤵
  PID:6840
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBACCAABACBAACCCCCCCACCBABCAABBCBCAABCACBAAACBCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBBBBCCAACBACCAAABCAACCAAACCACBBCCACBAACCBABCBCBCAC.exe" start= auto displayName= "UserDataSvc_CCBACCAABACBAACCCCCCCACCBABCAABBCBCAABCACBAAACBCCBA"
    3⤵
    PID:9988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBACCAABACBAACCCCCCCACCBABCAABBCBCAABCACBAAACBCCBA"
  2⤵
  PID:11304
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBACCAABACBAACCCCCCCACCBABCAABBCBCAABCACBAAACBCCBA"
    3⤵
    PID:13252

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCABBBCBACAABACBBACCBCABACCBBACACCACBCCABCBBABCBAAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCABBBCBACAABACBBACCBCABACCBBACACCACBCCABCBBABCBAAACA.exe
1⤵
PID:7960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBABBABCCABBACBABCBCCCBBBCBAAABCCBAACABCABACCAABACBACACBACABCCCBBAABABACBBCCBCCCBCBBBABAAAAABACCBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACABBCBAAACBCACBBBCCAABCCAAABACBABCCACACBBCCCCBAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBABBABCCABBACBABCBCCCBBBCBAAABCCBAACABCABACCAABACBACACBACABCCCBBAABABACBBCCBCCCBCBBBABAAAAABACCBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACABBCBAAACBCACBBBCCAABCCAAABACBABCCACACBBCCCCBAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACAACACACACBCCBABACACBCACCBBCBCBCBABCBCABCAABBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACABBCBAAACBCACBBBCCAABCCAAABACBABCCACACBBCCCCBAACC.exe" start= auto displayName= "UserDataSvc_BCACAACACACACBCCBABACACBCACCBBCBCBCBABCBCABCAABBBBB"
  2⤵
  PID:11132
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACAACACACACBCCBABACACBCACCBBCBCBCBABCBCABCAABBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACABBCBAAACBCACBBBCCAABCCAAABACBABCCACACBBCCCCBAACC.exe" start= auto displayName= "UserDataSvc_BCACAACACACACBCCBABACACBCACCBBCBCBCBABCBCABCAABBBBB"
    3⤵
    - Launches sc.exe
    PID:9296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACAACACACACBCCBABACACBCACCBBCBCBCBABCBCABCAABBBBB"
  2⤵
  PID:11296
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACAACACACACBCCBABACACBCACCBBCBCBCBABCBCABCAABBBBB"
    3⤵
    - Launches sc.exe
    PID:4864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAAAACCBCBCBBBCBBABBCBBBAACBBABBACAABBBBACCABBCACBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAAAACCBCBCBBBCBBABBCBBBAACBBABBACAABBBBACCABBCACBAB.exe
1⤵
PID:9212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCAABCBBCBBCCCABAACBCAABCCAACBBCCCCBBBABCCCBBCBCCABACBAABBACBACBCACAABCBABBBBBCBCBACBCBABACCAACCAACCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBBCBAAABCCCAABBAACBCBBCAACCBBAAAABBCBABBBBAAAACBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCAABCBBCBBCCCABAACBCAABCCAACBBCCCCBBBABCCCBBCBCCABACBAABBACBACBCACAABCBABBBBBCBCBACBCBABACCAACCAACCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBBCBAAABCCCAABBAACBCBBCAACCBBAAAABBCBABBBBAAAACBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABACBCBCABAAACACABBBAABBBBCBBCBCAACCACCACBCBAABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBBCBAAABCCCAABBAACBCBBCAACCBBAAAABBCBABBBBAAAACBAB.exe" start= auto displayName= "UserDataSvc_BCABACBCBCABAAACACABBBAABBBBCBBCBCAACCACCACBCBAABCB"
  2⤵
  PID:10688
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABACBCBCABAAACACABBBAABBBBCBBCBCAACCACCACBCBAABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBBCBAAABCCCAABBAACBCBBCAACCBBAAAABBCBABBBBAAAACBAB.exe" start= auto displayName= "UserDataSvc_BCABACBCBCABAAACACABBBAABBBBCBBCBCAACCACCACBCBAABCB"
    3⤵
    - Launches sc.exe
    PID:12156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABACBCBCABAAACACABBBAABBBBCBBCBCAACCACCACBCBAABCB"
  2⤵
  PID:11864
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABACBCBCABAAACACABBBAABBBBCBBCBCAACCACCACBCBAABCB"
    3⤵
    PID:12656

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCBBACAAAAAABACCACBBACCBCBABBACCCBCCAABBACAABCAABAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCBBACAAAAAABACCACBBACCBCBABBACCCBCCAABBACAABCAABAAA.exe
1⤵
PID:4656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBABBBBBABCACCBAAAAAACBCBBBCAABCBCBBCCCBAACABBCCCCBBBCBCCBCCBBCACCCABABCCBBABABBAABCBABCCCABABABBBCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABCAAABBCAAAAABAACBCACBACCABAAAACCCBBBCAAACAABBBBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBABBBBBABCACCBAAAAAACBCBBBCAABCBCBBCCCBAACABBCCCCBBBCBCCBCCBBCACCCABABCCBBABABBAABCBABCCCABABABBBCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABCAAABBCAAAAABAACBCACBACCABAAAACCCBBBCAAACAABBBBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:10368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCCCACCBBAABCCAAACBCCBAAACABBBABABCAAAABBCBABCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABCAAABBCAAAAABAACBCACBACCABAAAACCCBBBCAAACAABBBBBCC.exe" start= auto displayName= "UserDataSvc_CBCCCCACCBBAABCCAAACBCCBAAACABBBABABCAAAABBCBABCCBA"
  2⤵
  PID:10512
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCCCACCBBAABCCAAACBCCBAAACABBBABABCAAAABBCBABCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABCAAABBCAAAAABAACBCACBACCABAAAACCCBBBCAAACAABBBBBCC.exe" start= auto displayName= "UserDataSvc_CBCCCCACCBBAABCCAAACBCCBAAACABBBABABCAAAABBCBABCCBA"
    3⤵
    - Launches sc.exe
    PID:12808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCCCACCBBAABCCAAACBCCBAAACABBBABABCAAAABBCBABCCBA"
  2⤵
  PID:12104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCAAAACBAABABACABCBAACBCCACCBCCBCCBCCABABAABACCBACBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCAAAACBAABABACABCBAACBCCACCBCCBCCBCCABABAABACCBACBAA.exe
1⤵
PID:8228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBACBCABCBCBABBBACCABAACBBAACCABAAACCBACCCABBBACBACCAAACACCCAACCBAAACAABAACBAABBAACAAAAAABAAABCABCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBBBCCBCBACABBCBBBBCCCABABBBBCBAAACBCBBBCABBABCABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBACBCABCBCBABBBACCABAACBBAACCABAAACCBACCCABBBACBACCAAACACCCAACCBAAACAABAACBAABBAACAAAAAABAAABCABCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBBBCCBCBACABBCBBBBCCCABABBBBCBAAACBCBBBCABBABCABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCCAABAABCAABAABACBBCCCBCBCACBABBCBAABCCAABCBBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBBBCCBCBACABBCBBBBCCCABABBBBCBAAACBCBBBCABBABCABAC.exe" start= auto displayName= "UserDataSvc_CBBCCAABAABCAABAABACBBCCCBCBCACBABBCBAABCCAABCBBCCC"
  2⤵
  PID:11540
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCCAABAABCAABAABACBBCCCBCBCACBABBCBAABCCAABCBBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBBBCCBCBACABBCBBBBCCCABABBBBCBAAACBCBBBCABBABCABAC.exe" start= auto displayName= "UserDataSvc_CBBCCAABAABCAABAABACBBCCCBCBCACBABBCBAABCCAABCBBCCC"
    3⤵
    PID:12736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCCAABAABCAABAABACBBCCCBCBCACBABBCBAABCCAABCBBCCC"
  2⤵
  PID:12488
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBCCAABAABCAABAABACBBCCCBCBCACBABBCBAABCCAABCBBCCC"
    3⤵
    PID:13364

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAAAACCBCBCBBBCBBABBCBBBAACBBABBACAABBBBACCABBCACBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAAAACCBCBCBBBCBBABBCBBBAACBBABBACAABBBBACCABBCACBAB.exe
1⤵
PID:8540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABBBBCCCBABBABABBCACCCBBCBCAAACAABCCABBCBBABABAACCBBACCBBAAABABBBBBAAABABBBCCCABABBACCCCCBCACACABBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABBCBCABCAACBCCBACBCBCCABABBCBAAACBBBACABBABACAACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10552
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABBBBCCCBABBABABBCACCCBBCBCAAACAABCCABBCBBABABAACCBBACCBBAAABABBBBBAAABABBBCCCABABBACCCCCBCACACABBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABBCBCABCAACBCCBACBCBCCABABBCBAAACBBBACABBABACAACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACAABCAACCAAAABBCBCABBCACABBCBCBCBAACCCBABBACBBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABBCBCABCAACBCCBACBCBCCABABBCBAAACBBBACABBABACAACBA.exe" start= auto displayName= "UserDataSvc_BACAABCAACCAAAABBCBCABBCACABBCBCBCBAACCCBABBACBBAAA"
  2⤵
  PID:7700
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACAABCAACCAAAABBCBCABBCACABBCBCBCBAACCCBABBACBBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABBCBCABCAACBCCBACBCBCCABABBCBAAACBBBACABBABACAACBA.exe" start= auto displayName= "UserDataSvc_BACAABCAACCAAAABBCBCABBCACABBCBCBCBAACCCBABBACBBAAA"
    3⤵
    - Launches sc.exe
    PID:8084

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCAAAACBAABABACABCBAACBCCACCBCCBCCBCCABABAABACCBACBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCAAAACBAABABACABCBAACBCCACCBCCBCCBCCABABAABACCBACBAA.exe
1⤵
PID:4252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABACBABCAACBBCBBBCBCCCAABBCCAAAABACCACBCCBABCACCBABAABACCCBACBABCCBCACBACCBCAAABCBCBCABACCCCBBBBACACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABABCCCACACACAACCACAACCBBACACBAACBCBCBBBAAAACCAAACAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABACBABCAACBBCBBBCBCCCAABBCCAAAABACCACBCCBABCACCBABAABACCCBACBABCCBCACBACCBCAAABCBCBCABACCCCBBBBACACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABABCCCACACACAACCACAACCBBACACBAACBCBCBBBAAAACCAAACAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABBCBCBBBBBCABABAABBAACACBCACCBBBACBBBBCCCBABBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABABCCCACACACAACCACAACCBBACACBAACBCBCBBBAAAACCAAACAAB.exe" start= auto displayName= "UserDataSvc_BBABBCBCBBBBBCABABAABBAACACBCACCBBBACBBBBCCCBABBCAC"
  2⤵
  PID:6820
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBABBCBCBBBBBCABABAABBAACACBCACCBBBACBBBBCCCBABBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABABCCCACACACAACCACAACCBBACACBAACBCBCBBBAAAACCAAACAAB.exe" start= auto displayName= "UserDataSvc_BBABBCBCBBBBBCABABAABBAACACBCACCBBBACBBBBCCCBABBCAC"
    3⤵
    - Launches sc.exe
    PID:13096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBABBCBCBBBBBCABABAABBAACACBCACCBBBACBBBBCCCBABBCAC"
  2⤵
  PID:11376
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBABBCBCBBBBBCABABAABBAACACBCACCBBBACBBBBCCCBABBCAC"
    3⤵
    - Launches sc.exe
    PID:8900

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABACBCBCABCAABBABCBCCAACBCBBACCCACCBBABBBCCABBBCCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABACBCBCABCAABBABCBCCAACBCBBACCCACCBBABBBCCABBBCCBCB.exe
1⤵
PID:5044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCAACAABAAABBBAAACCCBCBCAACBBBCBBBBCCCAAAAACCBABBABBBBAAAABACAACABCBCBCBCCABACBBBCAACBABCCCABCABCBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBACAABABCCCBABAACCABCAACCBCAAAAACBCBAACCCCBAAAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7064
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCAACAABAAABBBAAACCCBCBCAACBBBCBBBBCCCAAAAACCBABBABBBBAAAABACAACABCBCBCBCCABACBBBCAACBABCCCABCABCBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBACAABABCCCBABAACCABCAACCBCAAAAACBCBAACCCCBAAAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBBBCBBABCACACCCABBACCCAACAAABBCBABAACCBCBCBCABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBACAABABCCCBABAACCABCAACCBCAAAAACBCBAACCCCBAAAAACB.exe" start= auto displayName= "UserDataSvc_CACBBBCBBABCACACCCABBACCCAACAAABBCBABAACCBCBCBCABBB"
  2⤵
  PID:11712
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBBBCBBABCACACCCABBACCCAACAAABBCBABAACCBCBCBCABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBACAABABCCCBABAACCABCAACCBCAAAAACBCBAACCCCBAAAAACB.exe" start= auto displayName= "UserDataSvc_CACBBBCBBABCACACCCABBACCCAACAAABBCBABAACCBCBCBCABBB"
    3⤵
    PID:12976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBBBCBBABCACACCCABBACCCAACAAABBCBABAACCBCBCBCABBB"
  2⤵
  PID:11468
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACBBBCBBABCACACCCABBACCCAACAAABBCBABAACCBCBCBCABBB"
    3⤵
    PID:13916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABCBCACAAAACACBABBBBBBCABAACBCCCCCBBBBACCBCBCACBAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABCBCACAAAACACBABBBBBBCABAACBCCCCCBBBBACCBCBCACBAABB.exe
1⤵
PID:7984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABACCABCAACBCBCBBACCACAABBABABCCCBCCCCCBBABACBAABABAAAABACBCABBCBACAABBBBBBABBCBACCABBABBABBACCCABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABACCABCAACBCBCBBACCACAABBABABCCCBCCCCCBBABACBAABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABACCABCAACBCBCBBACCACAABBABABCCCBCCCCCBBABACBAABABAAAABACBCABBCBACAABBBBBBABBCBACCABBABBABBACCCABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABACCABCAACBCBCBBACCACAABBABABCCCBCCCCCBBABACBAABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCACBCBAABBBCCABCCACAACCBCBAAABBACABABBBBCCABBABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABACCABCAACBCBCBBACCACAABBABABCCCBCCCCCBBABACBAABABA.exe" start= auto displayName= "UserDataSvc_BBCACBCBAABBBCCABCCACAACCBCBAAABBACABABBBBCCABBABAB"
  2⤵
  PID:12692
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCACBCBAABBBCCABCCACAACCBCBAAABBACABABBBBCCABBABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABACCABCAACBCBCBBACCACAABBABABCCCBCCCCCBBABACBAABABA.exe" start= auto displayName= "UserDataSvc_BBCACBCBAABBBCCABCCACAACCBCBAAABBACABABBBBCCABBABAB"
    3⤵
    PID:11724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCACBCBAABBBCCABCCACAACCBCBAAABBACABABBBBCCABBABAB"
  2⤵
  PID:13224

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCBCBABAAAABAABBBCCCBBABACCBCACBACBCBBABCACBABAABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCBCBABAAAABAABBBCCCBBABACCBCACBACBCBBABCACBABAABAAB.exe
1⤵
PID:904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBABBACACBBCCACAAACCBAABAABBBBBAAAABBCCABABACBCCBBCACABBCBAABABAAACAACABBABBBCBCAACCAACACBBCCCBCCCBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABACCABCAACBCBCBBACCACAABBABABCCCBCCCCCBBABACBAABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4432
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBABBACACBBCCACAAACCBAABAABBBBBAAAABBCCABABACBCCBBCACABBCBAABABAAACAACABBABBBCBCAACCAACACBBCCCBCCCBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABACCABCAACBCBCBBACCACAABBABABCCCBCCCCCBBABACBAABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:12228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABABBBBCBBABCACAACBBABBBCCACBCACBCCBBCBBBCAAABCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABACCABCAACBCBCBBACCACAABBABABCCCBCCCCCBBABACBAABABA.exe" start= auto displayName= "UserDataSvc_AAABABBBBCBBABCACAACBBABBBCCACBCACBCCBBCBBBCAAABCBB"
  2⤵
  PID:7300
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABABBBBCBBABCACAACBBABBBCCACBCACBCCBBCBBBCAAABCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABACCABCAACBCBCBBACCACAABBABABCCCBCCCCCBBABACBAABABA.exe" start= auto displayName= "UserDataSvc_AAABABBBBCBBABCACAACBBABBBCCACBCACBCCBBCBBBCAAABCBB"
    3⤵
    - Launches sc.exe
    PID:7052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABABBBBCBBABCACAACBBABBBCCACBCACBCCBBCBBBCAAABCBB"
  2⤵
  PID:8652

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABACBCBCABCAABBABCBCCAACBCBBACCCACCBBABBBCCABBBCCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABACBCBCABCAABBABCBCCAACBCBBACCCACCBBABBBCCABBBCCBCB.exe
1⤵
PID:8744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCACCBCACCAAAABAABCBCBACBCABBCCBAAABACCBBACBBCCBBAAAABCCACBBACCABABCCCBCBCACACBCCCAABABCCBBBABCBCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCCBBBBABCABBCBCBABCBBBCACCCCCBABBCACBCCAABBBACACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCACCBCACCAAAABAABCBCBACBCABBCCBAAABACCBBACBBCCBBAAAABCCACBBACCABABCCCBCBCACACBCCCAABABCCBBBABCBCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCCBBBBABCABBCBCBABCBBBCACCCCCBABBCACBCCAABBBACACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:11556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACAAABACACAACABBCACBBBBCAAABAABBCCCCAABBACACCCACBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCCBBBBABCABBCBCBABCBBBCACCCCCBABBCACBCCAABBBACACCC.exe" start= auto displayName= "UserDataSvc_ACAAABACACAACABBCACBBBBCAAABAABBCCCCAABBACACCCACBAC"
  2⤵
  PID:13084
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACAAABACACAACABBCACBBBBCAAABAABBCCCCAABBACACCCACBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCCBBBBABCABBCBCBABCBBBCACCCCCBABBCACBCCAABBBACACCC.exe" start= auto displayName= "UserDataSvc_ACAAABACACAACABBCACBBBBCAAABAABBCCCCAABBACACCCACBAC"
    3⤵
    - Launches sc.exe
    PID:1552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCBBACAAAAAABACCACBBACCBCBABBACCCBCCAABBACAABCAABAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCBBACAAAAAABACCACBBACCBCBABBACCCBCCAABBACAABCAABAAA.exe
1⤵
PID:7788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCABCBACBAABCCACABCCCCCCBCABCBAABABABBCBCCACBBCCCCCCCACABAABBACCABBBABBBBBACACBBBBBAABBACABCCCBAACCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABACCCBAABAABABAABCABCAACBACAAABBCBCABABBAABCCCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCABCBACBAABCCACABCCCCCCBCABCBAABABABBCBCCACBBCCCCCCCACABAABBACCABBBABBBBBACACBBBBBAABBACABCCCBAACCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABACCCBAABAABABAABCABCAACBACAAABBCBCABABBAABCCCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAACACBCCBCCAAABCABBCABCACCABABAABBCCCABCABBCACCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABACCCBAABAABABAABCABCAACBACAAABBCBCABABBAABCCCAAB.exe" start= auto displayName= "UserDataSvc_CCAACACBCCBCCAAABCABBCABCACCABABAABBCCCABCABBCACCAB"
  2⤵
  PID:8092
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCAACACBCCBCCAAABCABBCABCACCABABAABBCCCABCABBCACCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABACCCBAABAABABAABCABCAACBACAAABBCBCABABBAABCCCAAB.exe" start= auto displayName= "UserDataSvc_CCAACACBCCBCCAAABCABBCABCACCABABAABBCCCABCABBCACCAB"
    3⤵
    PID:11424

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCBCBABAAAABAABBBCCCBBABACCBCACBACBCBBABCACBABAABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCBCBABAAAABAABBBCCCBBABACCBCACBACBCBBABCACBABAABAAB.exe
1⤵
PID:1716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCABBACCCCBBBBACACBBBAACACACACBAABACCABACACBACCCCBCCABCABBBBBBBBCBCBACAACBABACBBAACABBABAABCCACCBBBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBAABAABCCBCBAAAACBBABABCACACCBBAAAABBACABABCAABBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:12084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCABBACCCCBBBBACACBBBAACACACACBAABACCABACACBACCCCBCCABCABBBBBBBBCBCBACAACBABACBBAACABBABAABCCACCBBBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBAABAABCCBCBAAAACBBABABCACACCBBAAAABBACABABCAABBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:12096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBAAAAACCCCCBBBBCACAACCACBBBBAACCCCACCBAAAACBAABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBAABAABCCBCBAAAACBBABABCACACCBBAAAABBACABABCAABBAAB.exe" start= auto displayName= "UserDataSvc_BBBAAAAACCCCCBBBBCACAACCACBBBBAACCCCACCBAAAACBAABCB"
  2⤵
  PID:12388
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBAAAAACCCCCBBBBCACAACCACBBBBAACCCCACCBAAAACBAABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBAABAABCCBCBAAAACBBABABCACACCBBAAAABBACABABCAABBAAB.exe" start= auto displayName= "UserDataSvc_BBBAAAAACCCCCBBBBCACAACCACBBBBAACCCCACCBAAAACBAABCB"
    3⤵
    - Launches sc.exe
    PID:13264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBAAAAACCCCCBBBBCACAACCACBBBBAACCCCACCBAAAACBAABCB"
  2⤵
  PID:12544
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBAAAAACCCCCBBBBCACAACCACBBBBAACCCCACCBAAAACBAABCB"
    3⤵
    - Launches sc.exe
    PID:11680

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABCBCACAAAACACBABBBBBBCABAACBCCCCCBBBBACCBCBCACBAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABCBCACAAAACACBABBBBBBCABAACBCCCCCBBBBACCBCBCACBAABB.exe
1⤵
PID:1368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCABBACCCCBBBBACACBBBAACACACACBAABACCABACACBACCCCBCCABCABBBBBBBBCBCBACAACBABACBBAACABBABAABCCACCBBBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACAABCBBCCAACCACCCBAAACCABAACBCBBCBABACCACCAACBCCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:12112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCABBACCCCBBBBACACBBBAACACACACBAABACCABACACBACCCCBCCABCABBBBBBBBCBCBACAACBABACBBAACABBABAABCCACCBBBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACAABCBBCCAACCACCCBAAACCABAACBCBBCBABACCACCAACBCCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCBBBCCABBCACBAABAACBABBCCBCACBABBCCCCBBBBCCBAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACAABCBBCCAACCACCCBAAACCABAACBCBBCBABACCACCAACBCCCCC.exe" start= auto displayName= "UserDataSvc_BBCCBBBCCABBCACBAABAACBABBCCBCACBABBCCCCBBBBCCBAABB"
  2⤵
  PID:3480
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCBBBCCABBCACBAABAACBABBCCBCACBABBCCCCBBBBCCBAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACAABCBBCCAACCACCCBAAACCABAACBCBBCBABACCACCAACBCCCCC.exe" start= auto displayName= "UserDataSvc_BBCCBBBCCABBCACBAABAACBABBCCBCACBABBCCCCBBBBCCBAABB"
    3⤵
    - Launches sc.exe
    PID:12532

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABBCABCBACCACABAAAACBAAABCCBCACCCAAABACACCAACBBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABBCABCBACCACABAAAACBAAABCCBCACCCAAABACACCAACBBCCCC.exe
1⤵
PID:2384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCBCBCCAABBBCBBACABBACABCCBBBCCBAAACBCACBBBCBBCBABACBBACABCCACBCCACBABAACBBCCBABCBBCCACBBCABBABBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABABCBCBACBCBBBCACAACCAAABCACCAAACCABAACBBCBCBCCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCBCBCCAABBBCBBACABBACABCCBBBCCBAAACBCACBBBCBBCBABACBBACABCCACBCCACBABAACBBCCBABCBBCCACBBCABBABBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABABCBCBACBCBBBCACAACCAAABCACCAAACCABAACBBCBCBCCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBACCACBCABCAACABCAACCBABABCBBCCCACBCABBACBBCACBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABABCBCBACBCBBBCACAACCAAABCACCAAACCABAACBBCBCBCCBABB.exe" start= auto displayName= "UserDataSvc_CCBACCACBCABCAACABCAACCBABABCBBCCCACBCABBACBBCACBBC"
  2⤵
  PID:1296
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBACCACBCABCAACABCAACCBABABCBBCCCACBCABBACBBCACBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABABCBCBACBCBBBCACAACCAAABCACCAAACCABAACBBCBCBCCBABB.exe" start= auto displayName= "UserDataSvc_CCBACCACBCABCAACABCAACCBABABCBBCCCACBCABBACBBCACBBC"
    3⤵
    PID:13376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBACCACBCABCAACABCAACCBABABCBBCCCACBCABBACBBCACBBC"
  2⤵
  PID:7388

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABBCABCBACCACABAAAACBAAABCCBCACCCAAABACACCAACBBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABBCABCBACCACABAAAACBAAABCCBCACCCAAABACACCAACBBCCCC.exe
1⤵
PID:9112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABCCBCABCAACAAABCAABBABCBCCAABCBCCCCAAAABABBBABAAACBCCBCCCCCABBBAABBACBBBBCACCBCAAAABABBCACCAABBCBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBAABAAAABCBCABBCCCBBBCAABCACCBACBACBBAABBCBCCBBBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABCCBCABCAACAAABCAABBABCBCCAABCBCCCCAAAABABBBABAAACBCCBCCCCCABBBAABBACBBBBCACCBCAAAABABBCACCAABBCBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBAABAAAABCBCABBCCCBBBCAABCACCBACBACBBAABBCBCCBBBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:10892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCABCCAACCABCBBAACBCAABCBAACCACBACBCACBBCABCCCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBAABAAAABCBCABBCCCBBBCAABCACCBACBACBBAABBCBCCBBBBAB.exe" start= auto displayName= "UserDataSvc_BBCCABCCAACCABCBBAACBCAABCBAACCACBACBCACBBCABCCCAAA"
  2⤵
  PID:11520
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCABCCAACCABCBBAACBCAABCBAACCACBACBCACBBCABCCCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBAABAAAABCBCABBCCCBBBCAABCACCBACBACBBAABBCBCCBBBBAB.exe" start= auto displayName= "UserDataSvc_BBCCABCCAACCABCBBAACBCAABCBAACCACBACBCACBBCABCCCAAA"
    3⤵
    PID:12700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBACBCCCCAAAABABBBAABCBBCCCCBBCBACCCAABCBCABCAAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBACBCCCCAAAABABBBAABCBBCCCCBBCBACCCAABCBCABCAAABAB.exe
1⤵
PID:8924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAABACCAACCBBACAABCCABBCAAACBCAAACBACBCBAABBAABBABBCBBAACABBBBBAAACCCABCCCACBAAAABBCCBCCCBAACABBACABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACABBBBCACACACBAACABCCACBBCACCBBBABCBCCBBCBACCCBABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAABACCAACCBBACAABCCABBCAAACBCAAACBACBCBAABBAABBABBCBBAACABBBBBAAACCCABCCCACBAAAABBCCBCCCBAACABBACABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACABBBBCACACACBAACABCCACBBCACCBBBABCBCCBBCBACCCBABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:14056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBACBCCCCAAAABABBBAABCBBCCCCBBCBACCCAABCBCABCAAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBACBCCCCAAAABABBBAABCBBCCCCBBCBACCCAABCBCABCAAABAB.exe
1⤵
PID:5068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAABBCBCACABAACCCCCAACABCAACBABCABBBCBCACACABABABBCBBCAABABACBACBBCACAABAACBBBBBBBBAACBBBCCBCAAABBBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBCBCACABAACCCCCAACABCAACBABCABBBCBCACACABABABBCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAABBCBCACABAACCCCCAACABCAACBABCABBBCBCACACABABABBCBBCAABABACBACBBCACAABAACBBBBBBBBAACBBBCCBCAAABBBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBCBCACABAACCCCCAACABCAACBABCABBBCBCACACABABABBCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:8664

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABBAAABBACCBBAAABAACACACAAAACBCCCBCACCCBBBBAAAABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABBAAABBACCBBAAABAACACACAAAACBCCCBCACCCBBBBAAAABBAA.exe
1⤵
PID:9652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBABBACACBBCCACAAACCBAABAABBBBBAAAABBCCABABACBCCBBCACABBCBAABABAAACAACABBABBBCBCAACCAACACBBCCCBCCCBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABBBBBCBCACBCABCCABABAAAACCCAAABBABABCBCCCBBCBCBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBABBACACBBCCACAAACCBAABAABBBBBAAAABBCCABABACBCCBBCACABBCBAABABAAACAACABBABBBCBCAACCAACACBBCCCBCCCBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABBBBBCBCACBCABCCABABAAAACCCAAABBABABCBCCCBBCBCBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:11700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACAABCAACCAAAABBCBCABBCACABBCBCBCBAACCCBABBACBBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABBBBBCBCACBCABCCABABAAAACCCAAABBABABCBCCCBBCBCBABA.exe" start= auto displayName= "UserDataSvc_BACAABCAACCAAAABBCBCABBCACABBCBCBCBAACCCBABBACBBAAA"
  2⤵
  PID:7356
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACAABCAACCAAAABBCBCABBCACABBCBCBCBAACCCBABBACBBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABBBBBCBCACBCABCCABABAAAACCCAAABBABABCBCCCBBCBCBABA.exe" start= auto displayName= "UserDataSvc_BACAABCAACCAAAABBCBCABBCACABBCBCBCBAACCCBABBACBBAAA"
    3⤵
    - Launches sc.exe
    PID:12556

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACCAACBCCCCACABAACCCCAAAAABCBBBACBABBBAAAACACBACCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACCAACBCCCCACABAACCCCAAAAABCBBBACBABBBAAAACACBACCAA.exe
1⤵
PID:9668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBACBCBBCBACAAACABBBAAABBCABAAACBCCCAABBBABAAAACCBCCBCBAAABABBBBCCABCCCABCBCBCABBCAACABABBCABCCBCBBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBBBBCBAAAACCABBABBBCABBABCABAABAACBBACACBBBCACCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBACBCBBCBACAAACABBBAAABBCABAAACBCCCAABBBABAAAACCBCCBCBAAABABBBBCCABCCCABCBCBCABBCAACABABBCABCCBCBBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBBBBCBAAAACCABBABBBCABBABCABAABAACBBACACBBBCACCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:2848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABACCBBAAACBBCBCBABCABBCCCBAACCBBBBCCAAAABABACABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBBBBCBAAAACCABBABBBCABBABCABAABAACBBACACBBBCACCCBA.exe" start= auto displayName= "UserDataSvc_BBABACCBBAAACBBCBCBABCABBCCCBAACCBBBBCCAAAABABACABA"
  2⤵
  PID:12824
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBABACCBBAAACBBCBCBABCABBCCCBAACCBBBBCCAAAABABACABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBBBBCBAAAACCABBABBBCABBABCABAABAACBBACACBBBCACCCBA.exe" start= auto displayName= "UserDataSvc_BBABACCBBAAACBBCBCBABCABBCCCBAACCBBBBCCAAAABABACABA"
    3⤵
    - Launches sc.exe
    PID:11828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBABACCBBAAACBBCBCBABCABBCCCBAACCBBBBCCAAAABABACABA"
  2⤵
  PID:13080

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACCAACBCCCCACABAACCCCAAAAABCBBBACBABBBAAAACACBACCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACCAACBCCCCACABAACCCCAAAAABCBBBACBABBBAAAACACBACCAA.exe
1⤵
PID:9772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAACAABCBABAABBABCCBBAAABAAABCCBCBACCAAABCAACCBACACCABBBBCCBBBCCACBCBCCCABAABACBCAAABAABBBBAAAABAABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBCAACACCCABACAABABABAACBACBAAAAAACAABABCCAAACCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAACAABCBABAABBABCCBBAAABAAABCCBCBACCAAABCAACCBACACCABBBBCCBBBCCACBCBCCCABAABACBCAAABAABBBBAAAABAABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBCAACACCCABACAABABABAACBACBAAAAAACAABABCCAAACCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:12220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBBCBACBCACBAACBAAACBABBCABCCABCBBBBCCACABBACBCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBCAACACCCABACAABABABAACBACBAAAAAACAABABCCAAACCBCA.exe" start= auto displayName= "UserDataSvc_ACBBCBACBCACBAACBAAACBABBCABCCABCBBBBCCACABBACBCABC"
  2⤵
  PID:12464
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBBCBACBCACBAACBAAACBABBCABCCABCBBBBCCACABBACBCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBCAACACCCABACAABABABAACBACBAAAAAACAABABCCAAACCBCA.exe" start= auto displayName= "UserDataSvc_ACBBCBACBCACBAACBAAACBABBCABCCABCBBBBCCACABBACBCABC"
    3⤵
    - Launches sc.exe
    PID:11404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBBCBACBCACBAACBAAACBABBCABCCABCBBBBCCACABBACBCABC"
  2⤵
  PID:13296

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBABABABAACCCCCBBBBBAAAABCAABACBBACCCAAACCCCACAABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBABABABAACCCCCBBBBBAAAABCAABACBBACCCAAACCCCACAABBA.exe
1⤵
PID:9796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCCCCACBAABBBBBCBBCBBBCCBBBBCBBCACCCBBABCACCCBCBBACACBBCAAAACCBCBBCAACABCAAAACCAAAABCCABCCAAAABACABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBAACABABBCCABCAABCACAAABCCABABABCBABBAACABABBACABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCCCCACBAABBBBBCBBCBBBCCBBBBCBBCACCCBBABCACCCBCBBACACBBCAAAACCBCBBCAACABCAAAACCAAAABCCABCCAAAABACABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBAACABABBCCABCAABCACAAABCCABABABCBABBAACABABBACABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBABABABAABAAACAABBCAAAACCABABBCCBABBACACBBABAAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBAACABABBCCABCAABCACAAABCCABABABCBABBAACABABBACABC.exe" start= auto displayName= "UserDataSvc_BBBABABABAABAAACAABBCAAAACCABABBCCBABBACACBBABAAACA"
  2⤵
  PID:12528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCACCCBBCABBBBAACACCCAABCBCCCCBCCCAACCABCCCCCCABBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCACCCBBCABBBBAACACCCAABCBCCCCBCCCAACCABCCCCCCABBBB.exe
1⤵
PID:9804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBCCCACCCAAAACBABCBCCBABBAAABABAABABAABABAABCCCBAABAAABACBCAACCABCCABCBABBACCABCAAACAABCABABCCCABCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCACBAABBBBBCBBCBBBCCBBBBCBBCACCCBBABCACCCBCBBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11416
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBCCCACCCAAAACBABCBCCBABBAAABABAABABAABABAABCCCBAABAAABACBCAACCABCCABCBABBACCABCAAACAABCABABCCCABCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCACBAABBBBBCBBCBBBCCBBBBCBBCACCCBBABCACCCBCBBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:10764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCBCCACBCCAACAAAABAABCBACBCCCBCBBCCCAAABACBACBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCACBAABBBBBCBBCBBBCCBBBBCBBCACCCBBABCACCCBCBBACAC.exe" start= auto displayName= "UserDataSvc_ACBCBCCACBCCAACAAAABAABCBACBCCCBCBBCCCAAABACBACBCAA"
  2⤵
  PID:12416
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCBCCACBCCAACAAAABAABCBACBCCCBCBBCCCAAABACBACBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCACBAABBBBBCBBCBBBCCBBBBCBBCACCCBBABCACCCBCBBACAC.exe" start= auto displayName= "UserDataSvc_ACBCBCCACBCCAACAAAABAABCBACBCCCBCBBCCCAAABACBACBCAA"
    3⤵
    PID:7080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCBCCACBCCAACAAAABAABCBACBCCCBCBBCCCAAABACBACBCAA"
  2⤵
  PID:12880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABBAAABBACCBBAAABAACACACAAAACBCCCBCACCCBBBBAAAABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABBAAABBACCBBAAABAACACACAAAACBCCCBCACCCBBBBAAAABBAA.exe
1⤵
PID:9860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCCCAAACACCAABBCAACACCCBBAACCCBCBACACCBBBBBBABBCCACBACACCACCBACBAAABABCBAACACCBBAAAACABCABCBACBACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCABABBCABABBCACACCBBBCCBBBBAABACCABBAAAABCACAACBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCCCAAACACCAABBCAACACCCBBAACCCBCBACACCBBBBBBABBCCACBACACCACCBACBAAABABCBAACACCBBAAAACABCABCBACBACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCABABBCABABBCACACCBBBCCBBBBAABACCABBAAAABCACAACBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBBBBCBCCBCAAACACBBCBABABBBACABCCCBCABABABBABBBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCABABBCABABBCACACCBBBCCBBBBAABACCABBAAAABCACAACBBAC.exe" start= auto displayName= "UserDataSvc_ACBBBBCBCCBCAAACACBBCBABABBBACABCCCBCABABABBABBBABA"
  2⤵
  PID:6600
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBBBBCBCCBCAAACACBBCBABABBBACABCCCBCABABABBABBBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCABABBCABABBCACACCBBBCCBBBBAABACCABBAAAABCACAACBBAC.exe" start= auto displayName= "UserDataSvc_ACBBBBCBCCBCAAACACBBCBABABBBACABCCCBCABABABBABBBABA"
    3⤵
    PID:10956

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBABABABAACCCCCBBBBBAAAABCAABACBBACCCAAACCCCACAABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBABABABAACCCCCBBBBBAAAABCAABACBBACCCAAACCCCACAABBA.exe
1⤵
PID:9888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCBCBCCAABBBCBBACABBACABCCBBBCCBAAACBCACBBBCBBCBABACBBACABCCACBCCACBABAACBBCCBABCBBCCACBBCABBABBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBACACACACCCACCABCACCBABBBCCABBCCCBBBCBBACBBBACCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCBCBCCAABBBCBBACABBACABCCBBBCCBAAACBCACBBBCBBCBABACBBACABCCACBCCACBABAACBBCCBABCBBCCACBBCABBABBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBACACACACCCACCABCACCBABBBCCABBCCCBBBCBBACBBBACCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACAAAABAABAACABACCBACCCCBCAACABAACCCACCBCCBBCABBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBACACACACCCACCABCACCBABBBCCABBCCCBBBCBBACBBBACCACB.exe" start= auto displayName= "UserDataSvc_ACAAAABAABAACABACCBACCCCBCAACABAACCCACCBCCBBCABBCBA"
  2⤵
  PID:12596
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACAAAABAABAACABACCBACCCCBCAACABAACCCACCBCCBBCABBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBACACACACCCACCABCACCBABBBCCABBCCCBBBCBBACBBBACCACB.exe" start= auto displayName= "UserDataSvc_ACAAAABAABAACABACCBACCCCBCAACABAACCCACCBCCBBCABBCBA"
    3⤵
    - Launches sc.exe
    PID:7408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACAAAABAABAACABACCBACCCCBCAACABAACCCACCBCCBBCABBCBA"
  2⤵
  PID:5684
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACAAAABAABAACABACCBACCCCBCAACABAACCCACCBCCBBCABBCBA"
    3⤵
    PID:4592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACABCAABABBCBBBACABBCABCCCACBCCABCBAAAABCABCCCBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACABCAABABBCBBBACABBCABCCCACBCCABCBAAAABCABCCCBBBB.exe
1⤵
PID:6512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABAACCCBCCCACCACBBBBBACABCCCAACAABBCBCCCCABAACCBAACAACABCBACACAABBBBCAACCBBABCCCABCBCAAABCACCCBCAAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAAACBABBBBCCCABACAABACCABCACCABACCACBBABCCAABCBACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABAACCCBCCCACCACBBBBBACABCCCAACAABBCBCCCCABAACCBAACAACABCBACACAABBBBCAACCBBABCCCABCBCAAABCACCCBCAAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAAACBABBBBCCCABACAABACCABCACCABACCACBBABCCAABCBACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:12940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCCAAACCCCABCABCACACBBAABBBABABBABBCBBABBBABBCCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAAACBABBBBCCCABACAABACCABCACCABACCACBBABCCAABCBACAB.exe" start= auto displayName= "UserDataSvc_ABCCAAACCCCABCABCACACBBAABBBABABBABBCBBABBBABBCCCAC"
  2⤵
  PID:7956
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCCAAACCCCABCABCACACBBAABBBABABBABBCBBABBBABBCCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAAACBABBBBCCCABACAABACCABCACCABACCACBBABCCAABCBACAB.exe" start= auto displayName= "UserDataSvc_ABCCAAACCCCABCABCACACBBAABBBABABBABBCBBABBBABBCCCAC"
    3⤵
    PID:14068

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBCBABCABABAAABABBBCCCBABCABBABACABBBBAAACCBCCBAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBCBABCABABAAABABBBCCCBABCABBABACABBBBAAACCBCCBAACA.exe
1⤵
PID:6180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABABCABACCBBAAABCBACCCBBBCABBBCBCBCAABCCBCCAABCBBAABBCBABABCCBABABCAACCAACCAABBCCAAAACCABBBABCAABACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBCBBBCCBAABCAABBCCCACBCBCBBCABBCBABCACBBCCCABBBABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABABCABACCBBAAABCBACCCBBBCABBBCBCBCAABCCBCCAABCBBAABBCBABABCCBABABCAACCAACCAABBCCAAAACCABBBABCAABACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBCBBBCCBAABCAABBCCCACBCBCBBCABBCBABCACBBCCCABBBABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:12068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBACCCBBBBBCBCAACBABBCAABACCBBCBAABCCACBCBBACCBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBCBBBCCBAABCAABBCCCACBCBCBBCABBCBABCACBBCCCABBBABCB.exe" start= auto displayName= "UserDataSvc_ACBACCCBBBBBCBCAACBABBCAABACCBBCBAABCCACBCBBACCBAAB"
  2⤵
  PID:7036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABACACCCAACBBBABBBBBAABCBAABACAAAABCABCCCABACACCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABACACCCAACBBBABBBBBAABCBAABACAAAABCABCCCABACACCBCA.exe
1⤵
PID:10476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAAABCAACBBBCABBBCCBBABAABBABCCABCCACCBABACABCAACAACBCBBABBBAABCBCCCCABABAACCCCCBBABBCAAAABBABBAABACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACCCCCBACACBBCCABCBCACBBABCCBBAABAACCCABAAAABCBCBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11432

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBCBABCABABAAABABBBCCCBABCABBABACABBBBAAACCBCCBAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBCBABCABABAAABABBBCCCBABCABBABACABBBBAAACCBCCBAACA.exe
1⤵
PID:10756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBABABBABCAABAACCCCBCCBCACACCAACCBACBABCCACABCCCBBAACCCACCBAABACABAABBCBCACBBCACCCACCBCCBCBACBBAABCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAAACCCBACACCBACACAACAABCBBAACBAACCCAAAABAABCCBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBABABBABCAABAACCCCBCCBCACACCAACCBACBABCCACABCCCBBAACCCACCBAABACABAABBCBCACBBCACCCACCBCCBCBACBBAABCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAAACCCBACACCBACACAACAABCBBAACBAACCCAAAABAABCCBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:14036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABACBBCAAACBCCCCACAACCACBCCBCAACCCAACAAACBCACCCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABACBBCAAACBCCCCACAACCACBCCBCAACCCAACAAACBCACCCBCB.exe
1⤵
PID:10800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBBCAABBACAACCCBBAAAABBBACACABCAAAAABBCCCAACBCBAAAAABBACACBBCAACAACABAACBAABBBACAAAABBAACBACBBCBBBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCACBCCCCACCACCCACCCAAABBCBCABABBAABBABBCBBBAABCBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7544

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACABCAABABBCBBBACABBCABCCCACBCCABCBAAAABCABCCCBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACABCAABABBCBBBACABBCABCCCACBCCABCBAAAABCABCCCBBBB.exe
1⤵
PID:10648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBACCABABBBCACACAAABAABABACAAAACBBCBBACCCCAACCCCCBCBBBAABBACBCAAAAACABCCAAAABABBCBBBCABACBAACCBAAABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACAABBAABCBABBBCCBBBABBACBACABACACCCBCAAACCCBACABACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:14148

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACABCAABABBCBBBACABBCABCCCACBCCABCBAAAABCABCCCBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACABCAABABBCBBBACABBCABCCCACBCCABCBAAAABCABCCCBBBB.exe
1⤵
PID:7024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCABCBBCBBAABBBCAABCBCABACBCAABBAABBBABCACBBACCBCACAABCBABCACCCCABAAACCCABCBABCABCCCBBACABCBCAAABABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAABBBCCAACCCCCCCAABAACCABCBACAAAACACBAABABBCBBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:13880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACAACBCCBCAACABAABAABACBBACAABCCAABAAABCCAACABCCCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACAACBCCBCAACABAABAABACBBACAABCCAABAAABCCAACABCCCBAA.exe
1⤵
PID:912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBBBBCCAACBACCAAABCAACCAAACCACBBCCACBAACCBABCBCBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBBBBCCAACBACCAAABCAACCAAACCACBBCCACBAACCBABCBCBCAC.exe
1⤵
PID:11772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABABAAABBAAABACBBAACACABBACCBCCBBBACCCCAACACBABCCCAACBCAACCAABCBAAACACBCACBAABBCBCAABCCBCBBBCCBBABACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBBCCCCCABBACACCAABBBABABBCBBAAABACCAAACCCBACBABAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:12220
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABABAAABBAAABACBBAACACABBACCBCCBBBACCCCAACACBABCCCAACBCAACCAABCBAAACACBCACBAABBCBCAABCCBCBBBCCBBABACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBBCCCCCABBACACCAABBBABABBCBBAAABACCAAACCCBACBABAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:3604

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBBCBAAABCCCAABBAACBCBBCAACCBBAAAABBCBABBBBAAAACBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBBCBAAABCCCAABBAACBCBBCAACCBBAAAABBCBABBBBAAAACBAB.exe
1⤵
PID:11904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABACBCCBBBCCCBCABCAAAAACCCCCBCBAAAABCBCCCACBBCCACCCCBBABBCAAACAACBBABCACACAABCAACBABBBBCCACCBCCCCACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCAACACACACACAAABCCAACBAABCBCABAAABBAACBBCCAABCCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABACBCCBBBCCCBCABCAAAAACCCCCBCBAAAABCBCCCACBBCCACCCCBBABBCAAACAACBBABCACACAABCAACBABBBBCCACCBCCCCACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCAACACACACACAAABCCAACBAABCBCABAAABBAACBBCCAABCCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBACAABBAABCBABBBCCBBBABBACBACABACACCCBCAAACCCBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCAACACACACACAAABCCAACBAABCBCABAAABBAACBBCCAABCCBCB.exe" start= auto displayName= "UserDataSvc_ABBACAABBAABCBABBBCCBBBABBACBACABACACCCBCAAACCCBACA"
  2⤵
  PID:9660

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBBBCCBCBACABBCBBBBCCCABABBBBCBAAACBCBBBCABBABCABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBBBCCBCBACABBCBBBBCCCABABBBBCBAAACBCBBBCABBABCABAC.exe
1⤵
PID:11628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCBABABBBACCBBCBACCCCAABBAABCACCAACBBCBCCABABBBCACBBCBCABBCAAACCCABCCAAABBACCACBAABAABAABCBABABCBCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCBCAAAACCACABBAACABBBBBAACACBCABACCCAACBBCBABCCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:12588

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAACBBAACCABACBAABBAABBBABCAAAABCBAABCBCACCCABAACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAACBBAACCABACBAABBAABBBABCAAAABCBAABCBCACCCABAACBC.exe
1⤵
PID:11548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBABBBBCBBAABABAACACBBCBCBCBBABBCBBAABBABBCCBACABBBBABCBAACCBCABBCACCCBABACCBACBACCBABACBACBAAACACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBAABACAACCCACABBBBBAAAABBBACAAABCBBBACABBBBCCABAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8772

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACAACBCCBCAACABAABAABACBBACAABCCAABAAABCCAACABCCCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACAACBCCBCAACABAABAABACBBACAABCCAABAAABCCAACABCCCBAA.exe
1⤵
PID:11860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBBCABAAACCAABACACBCCBABCCBCAACCAABABCBACAACCCBCCBBABBAAAABCCAAACCBACCABCACCAABACAABAABABBCACACCBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCACACCACBCBBACACABACBACCCCCAABCBCBACACBCBCCBABBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:12836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBBCABAAACCAABACACBCCBABCCBCAACCAABABCBACAACCCBCCBBABBAAAABCCAAACCBACCABCACCAABACAABAABABBCACACCBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCACACCACBCBBACACABACBACCCCCAABCBCBACACBCBCCBABBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:14184

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACCCACBCBCCAABCBBCACCAACCBCBACABBCBABCCCABBABACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACCCACBCBCCAABCBBCACCAACCBCBACABBCBABCCCABBABACAC.exe
1⤵
PID:3020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABAACCACCACCABCAABCBBAACBCCCAABCCCBCBBABCCCCBABAACACBAABCBCBBCBCCCCBACAAACAABBCBBBABBBAABCBCCBCBBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCBBCBBABCABCCCABCCCCACACBBAACCBACBABABCCBCBAABCBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4652

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBABBCCAABCBCBACCCCCCAAAABBBCABABBBACBCABBBACACACCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBABBCCAABCBCBACCCCCCAAAABBBCABABBBACBCABBBACACACCBC.exe
1⤵
PID:5000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABAACCACCACCABCAABCBBAACBCCCAABCCCBCBBABCCCCBABAACACBAABCBCBBCBCCCCBACAAACAABBCBBBABBBAABCBCCBCBBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBAAACBBCBCBCCCBCCBBBACCABBBBABBBBAABACCBACBCBCCACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:13340

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBBAAAACAABACCCABACACCCBCBABBBACCABAABACCABAABABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBBAAAACAABACCCABACACCCBCBABBBACCABAABACCABAABABAAB.exe
1⤵
PID:11208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABAACCACCACCABCAABCBBAACBCCCAABCCCBCBBABCCCCBABAACACBAABCBCBBCBCCCCBACAAACAABBCBBBABBBAABCBCCBCBBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABCAAACACABCABCAAABCAAABCABABCBAACBABABAACABBACABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:13356

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABCAAABBCAAAAABAACBCACBACCABAAAACCCBBBCAAACAABBBBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABCAAABBCAAAAABAACBCACBACCABAAAACCCBBBCAAACAABBBBBCC.exe
1⤵
PID:6988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCAAABBBAACCBBCBAABCAACAAAABCCBACBBBBCCBABBACBCCCABCBABBACACCAACBCBCCBACCBBBCACBCCBAABACCABCACBCAACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBBAAACBCACCBCCCCCBCCACACCACBCCBCBABBABBBCBBCBAACCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:13460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACABBCBAAACBCACBBBCCAABCCAAABACBABCCACACBBCCCCBAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACABBCBAAACBCACBBBCCAABCCAAABACBABCCACACBBCCCCBAACC.exe
1⤵
PID:7124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACACBABBBABCBCCABBABCAAAABCBAACBAAABCCBBABABCBACCAABACACCBCABAACABAACAABCCAABACBABABABABCCCAABCCCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBBAABBAABBAACCCBCABBCAACCCACCBACAACAAAAABCABAABAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:12728

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACCCACBCBCCAABCBBCACCAACCBCBACABBCBABCCCABBABACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACCCACBCBCCAABCBBCACCAACCBCBACABBCBABCCCABBABACAC.exe
1⤵
PID:7108

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCAAAACAAABBBAACCBABAACAABCBBCBAABACBCCCBBCBBBCBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCAAAACAAABBBAACCBABAACAABCBBCBAABACBCCCBBCBBBCBABA.exe
1⤵
PID:8564

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABACACCCAACBBBABBBBBAABCBAABACAAAABCABCCCABACACCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABACACCCAACBBBABBBBBAABCBAABACAAAABCABCCCABACACCBCA.exe
1⤵
PID:7068

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBBBBCBAAAACCABBABBBCABBABCABAABAACBBACACBBBCACCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBBBBCBAAAACCABBABBBCABBABCABAABAACBBACACBBBCACCCBA.exe
1⤵
PID:11516

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACABBCBAAACBCACBBBCCAABCCAAABACBABCCACACBBCCCCBAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACABBCBAAACBCACBBBCCAABCCAAABACBABCCACACBBCCCCBAACC.exe
1⤵
PID:7916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABACBBCAAACBCCCCACAACCACBCCBCAACCCAACAAACBCACCCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABACBBCAAACBCCCCACAACCACBCCBCAACCCAACAAACBCACCCBCB.exe
1⤵
PID:2192

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBBAAAACAABACCCABACACCCBCBABBBACCABAABACCABAABABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBBAAAACAABACCCABACACCCBCBABBBACCABAABACCABAABABAAB.exe
1⤵
PID:12376

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBACAABABCCCBABAACCABCAACCBCAAAAACBCBAACCCCBAAAAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBACAABABCCCBABAACCABCAACCBCAAAAACBCBAACCCCBAAAAACB.exe
1⤵
PID:12892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBBACABBCCCAACCACAABCAACCCABBCBACBBACBBACACBBACABBBACCCCBBCCACCABCAABCACBBCBABCCACAABCBCAAAABCABBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAAACCCBACACCBACACAACAABCBBAACBAACCCAAAABAABCCBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8608

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBBCBAAABCCCAABBAACBCBBCAACCBBAAAABBCBABBBBAAAACBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBBCBAAABCCCAABBAACBCBBCAACCBBAAAABBCBABBBBAAAACBAB.exe
1⤵
PID:13104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACAACCABBBACCCAABAACABBCBCCCACBBBAABCAABCBCCAACBCCBBBCAABCBCBABBAAAAAABCBBBBABAAABCBCBABCAABBCCABACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCCACBABCBCABAABBBCCCACABACCBAABCABBBBAABCCBBBAAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACAACCABBBACCCAABAACABBCBCCCACBBBAABCAABCBCCAACBCCBBBCAABCBCBABBAAAAAABCBBBBABAAABCBCBABCAABBCCABACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCCACBABCBCABAABBBCCCACABACCBAABCABBBBAABCCBBBAAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9152

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCACAAAACBCCBACCABCCACCABACCBACCBACABCACBAABBACACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCCACAAAACBCCBACCABCCACCABACCBACCBACABCACBAABBACACAA.exe
1⤵
PID:13120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBBACBBCCAAACCAABABCBCCBBACAABACACBBCBCABBBCCBBABABAACAABBACAAACABBAACAABBBCAAACBCACCAAACABCCCCACCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBBABABBCBACAACCBBABACBABABCABCCCCABCCAAABCAAACACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:12456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABBBBBCBCACBCABCCABABAAAACCCAAABBABABCBCCCBBCBCBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABBBBBCBCACBCABCCABABAAAACCCAAABBABABCBCCCBBCBCBABA.exe
1⤵
PID:11268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABBBAAACBCACCBCCCCCBCCACACCACBCCBCBABBABBBCBBCBAACCAAACCBCABAACBCCBACCBABCBCBACBCCAACCCBBBBCCBBCBBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBBAAACBCACCBCCCCCBCCACACCACBCCBCBABBABBBCBBCBAACCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5752

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABACCABCAACBCBCBBACCACAABBABABCCCBCCCCCBBABACBAABABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABACCABCAACBCBCBBACCACAABBABABCCCBCCCCCBBABACBAABABA.exe
1⤵
PID:11880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBCAAACCCBACACCBACACAACAABCBBAACBAACCCAAAABAABCCBBCABBACCBBBBAAAABAACCAAABBBCBCCBCACBBACCCACCAACCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBBCCABABBCBABBBBAACABBACBACABAACCBCACBAACBBACACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11148
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBCAAACCCBACACCBACACAACAABCBBAACBAACCCAAAABAABCCBBCABBACCBBBBAAAABAACCAAABBBCBCCBCACBBACCCACCAACCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBBCCABABBCBABBBBAACABBACBACABAACCBCACBAACBBACACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:14172

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBBBBCCAACBACCAAABCAACCAAACCACBBCCACBAACCBABCBCBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBBBBCCAACBACCAAABCAACCAAACCACBBCCACBAACCBABCBCBCAC.exe
1⤵
PID:2628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCABABBBCBCCCBBCBCABAACBCBACCACACBCABBCBABCAAABBBCBABACACBCBBCCCABCBAACACCBBACBBCCBCCAAACABAACCCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACBACBBCBABBACAACABAACCAACBCBAABBCAACCBCBBCCCCBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCAAAACAAABBBAACCBABAACAABCBBCBAABACBCCCBBCBBBCBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCAAAACAAABBBAACCBABAACAABCBBCBAABACBCCCBBCBBBCBABA.exe
1⤵
PID:2700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABCCCBBCCBCACAAACACCCBCBCCBABBBBCCBCBCACABCBCBCBABBBAAABBAAABBCBABCCBACCCCABBACAACBBBACBABACAAAAABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAABBBABAABBBCAABAABCCBCBABBACABCCACABCACCACBACCAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8600

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBCBCCBBBBBCCAACACBCACABCCBACAAAACCAABBBBABCCACBABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBCBCCBBBBBCCAACACBCACABCCBACAAAACCAABBBBABCCACBABBA.exe
1⤵
PID:5436

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABABCCCACACACAACCACAACCBBACACBAACBCBCBBBAAAACCAAACAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABABCCCACACACAACCACAACCBBACACBAACBCBCBBBAAAACCAAACAAB.exe
1⤵
PID:11700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBAACABABBCCABCAABCACAAABCCABABABCBABBAACABABBACABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBAACABABBCCABCAABCACAAABCCABABABCBABBAACABABBACABC.exe
1⤵
PID:8136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBACACACACCCACCABCACCBABBBCCABBCCCBBBCBBACBBBACCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBACACACACCCACCABCACCBABBBCCABBCCCBBBCBBACBBBACCACB.exe
1⤵
PID:12484

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCACBAABBBBBCBBCBBBCCBBBBCBBCACCCBBABCACCCBCBBACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCACBAABBBBBCBBCBBBCCBBBBCBBCACCCBBABCACCCBCBBACAC.exe
1⤵
PID:7436

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABBCBCABCAACBCCBACBCBCCABABBCBAAACBBBACABBABACAACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABBCBCABCAACBCCBACBCBCCABABBCBAAACBBBACABBABACAACBA.exe
1⤵
PID:12028

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABABCBCBACBCBBBCACAACCAAABCACCAAACCABAACBBCBCBCCBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABABCBCBACBCBBBCACAACCAAABCACCAAACCABAACBBCBCBCCBABB.exe
1⤵
PID:8300

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBAABAABCCBCBAAAACBBABABCACACCBBAAAABBACABABCAABBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBAABAABCCBCBAAAACBBABABCACACCBBAAAABBACABABCAABBAAB.exe
1⤵
PID:3396

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBCAACACCCABACAABABABAACBACBAAAAAACAABABCCAAACCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBCAACACCCABACAABABABAACBACBAAAAAACAABABCCAAACCBCA.exe
1⤵
PID:7872

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBACACACACCCACCABCACCBABBBCCABBCCCBBBCBBACBBBACCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBACACACACCCACCABCACCBABBBCCABBCCCBBBCBBACBBBACCACB.exe
1⤵
PID:12676

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCABABBCABABBCACACCBBBCCBBBBAABACCABBAAAABCACAACBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCABABBCABABBCACACCBBBCCBBBBAABACCABBAAAABCACAACBBAC.exe
1⤵
PID:8048

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBAABAABCCBCBAAAACBBABABCACACCBBAAAABBACABABCAABBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBAABAABCCBCBAAAACBBABABCACACCBBAAAABBACABABCAABBAAB.exe
1⤵
PID:13592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBBBCCBCBACABBCBBBBCCCABABBBBCBAAACBCBBBCABBABCABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBBBCCBCBACABBCBBBBCCCABABBBBCBAAACBCBBBCABBABCABAC.exe
1⤵
PID:13672

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABABCCCACACACAACCACAACCBBACACBAACBCBCBBBAAAACCAAACAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABABCCCACACACAACCACAACCBBACACBAACBCBCBBBAAAACCAAACAAB.exe
1⤵
PID:13888

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABACCCBAABAABABAABCABCAACBACAAABBCBCABABBAABCCCAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABACCCBAABAABABAABCABCAACBACAAABBCBCABABBAABCCCAAB.exe
1⤵
PID:14276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAACBBAACCABACBAABBAABBBABCAAAABCBAABCBCACCCABAACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAACBBAACCABACBAABBAABBBABCAAAABCBAABCBCACCCABAACBC.exe
1⤵
PID:9768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBACAABABCCCBABAACCABCAACCBCAAAAACBCBAACCCCBAAAAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBACAABABCCCBABAACCABCAACCBCAAAAACBCBAACCCCBAAAAACB.exe
1⤵
PID:676

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAAACBABBBBCCCABACAABACCABCACCABACCACBBABCCAABCBACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAAACBABBBBCCCABACAABACCABCACCABACCACBBABCCAABCBACAB.exe
1⤵
PID:7456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCCBBBBABCABBCBCBABCBBBCACCCCCBABBCACBCCAABBBACACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCCBBBBABCABBCBCBABCBBBCACCCCCBABBCACBCCAABBBACACCC.exe
1⤵
PID:14112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

virus_log.txt

Path C:\Users\Admin\AppData\Local\Temp\virus_log.txt
Size 1KB
SHA256 8b8b2dd9fe4d6a476223975a617af8b465ba515f8b0ec015934c89b341fc26e4
MD5 02836c655d04dab2ba2b26fad5e3875c
SHA1 fff3639646963c9e5eb53f654966d4fd519b4297
SHA512 3faf2990b329b7141dadf51c90c210a5003dad73aa3b8b3047f777d103ef4db33fbd53db034698b2a203a3003f4aaafddfacae78037dbee06ebb09e50239cd53
TLSH
T17841782581AEDC37A22264D3E73DDFDA86D477932E481900A3554814F3DDC33DE164B2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c3f3d942dd2f393bdd4628424a273afbc9f4dbc169f75d3f5e48d05d661eefe3
MD5 63b177431aa23a7fbb910ffe91c8010a
SHA1 62b2ccb1bc24f880c94f4730ed41dcf697cadbfe
SHA512 987f422f82e269e40eee18ef52a78c3552c41800a8621de9a6c357b66a3c9e3ee38e21fa7553f3629caf9585865849cc92ed3818004f0ef420573063707c36a8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f788d05d775126cc651c8c232668f90881253feae3238051a2b9482668136d6e
MD5 819b26d22298dc505817a098f6164946
SHA1 9fdfb261a8b3ff6919507d92facc0f886bd13a48
SHA512 dd17bb1bd9fd33ad18f86d126c1886e2ec9aa1a8ae15e24d8c1db88e07ea7a98014dd890c42dbbc06f4e3dceb717c1da5fd0c6256f7c82e4dfab3b3835bbb0b0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8281d9abc9dbe9e45891cb6b9fc72378012cf004928e214cbc051b44e5f14281
MD5 3098726dd18dbbc0b5d002316e490c53
SHA1 627dbee568d13ed84113a72bd120efc432357e5a
SHA512 5f87ecdc96674605b0cca34de225a43af5e29158a208fb8c10d0cc7520f56d1ecaefe92c09f93ab71d464642df691337e3f3ebc027807f5e7e92d8faacdc33e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b4eaacf64efac15c0d0f2df44150bc269b4c4f6368a8b21f7783f541ea0ecb8a
MD5 be2328b9854ac63f9774407c278c9a5e
SHA1 71e212f704f341a909def95fd8e4a1b285174cb7
SHA512 e0886d59f6e4b3c910a7f14ecfcf5afc11c7f7497f4f9447019bf9c56a0c1220d5f9590e4169867e031d5b56b744ca4213183048e0099e1857923b4978a7861c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 77ce133b7d7683fd31095b6271b1d8c56f7bdd0fb4b08d2c2bf17edd8a320195
MD5 80cbd8e7fbc4b6e6d4ca53485a1d736e
SHA1 8f891e53fced65ecb18332706e6a5e5262762548
SHA512 94260648a0fe47c517ad6756ef77f6dec82c3814b93c5fa83bd1c02efe360814806d9796bd025baa1039f159ed1118939ab1529e24b79852e57ec2a70e29a6d1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ca881bd6037dbd57d6e28fbbdf352aa57f1d541af7de87594a71c136bfbe8620
MD5 f4ee062abe854157fbccf4242dfcd8e5
SHA1 4d009d7b0cdbe86855b03bac8d58815af8f47ac6
SHA512 acdae7a7504eae86445df77b62399f71d2034224ce201b74d744187f9a8dd434bf0a3d1e8319c7021139a58fdd93777c25fb0f5e5355a7d073e369437099e7ea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 23d36964088517400b095750299a9005c81783b00c5c9d3b5dd923ea6f087501
MD5 b796868159d3d2da1fb34e7fdba90411
SHA1 ffbec52960efeeec968050a78bc74bbaee553a97
SHA512 8e022f7c6473372b29ff9b77e9e71332f32871ea7c849c150e75d6701a4851ae502960aec0ce973e65893d05153cc6cbc6da1ad6943413fe5cdfd03ae24ee8dc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 152af496ad27c3a7411b84e436233db9e37f1f59eea095ec03f216026bce2490
MD5 db2d85313cf4530669382ad268238903
SHA1 521998f695394cb30894cfe9f7db8de526702e5f
SHA512 06d5c6b2b030207c32a730e90f5cc78abf0102c630c23a5b9d4b306a7f1b3c8f530553a26a42fd9337588c64a8f9ea96687402a32e5f7544f2cac21e4524edda
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ed0d4e05deb96c2a8d8c6527db23bd642162c35b5d748b7fd1848e882cdd765f
MD5 e49e7b093ad31b7a017c2dc981431ca5
SHA1 3f395b71494d5348ba0b511d55fb25c4e47223a8
SHA512 98971582c1c9f67b87da898a3a89c3da2602fdf9b13c8bb37fb0506f0b77f5e1783226d5fde86b7110820cdd519aaecb261afd76fcad87d56115c2aa13ead86a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7104baf488badc00b3053418045d3c2edd58269f484184aff61749f89dd19f4c
MD5 07361e1e108a896a9a7cd4212ce1e1d3
SHA1 e21b2fe631e55397730e75c862b573ca45ca92f4
SHA512 38dfb58403ffee934528de5e4c5f07bf17a41f07998c6bfee63089f055c10d3c30db85d6f5c4f680f322f9ca09d95ba28a5f44d727970845c24874894b888a66
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2438d7bba9349dfb17655cac4a057e545a3c62a4b464157bf01fb3d1266ae46c
MD5 6380095a09abb98249b44d7364918508
SHA1 fb4c28a31042c73141a9b7da2719439f87694192
SHA512 9bce532a2207baaa56490a42db4629ab9b15e36f5602092ba7a7368685d6da8cdc2aabfdc2b057c4877cbff16320798fd7aea7ca7e116d35c3c5950c4991b2c1
MD5 SHA1 SHA512

Submit Download

svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBBBCBBABBABAACCABAABBBABBCCCBABCAABCCBAACBABACACCA.exe
Size 18.7MB
SHA256 dd6134dd4af1cd4e040a8382f00cadee01fe3368ca3ad5d3b96bbe342f744d8a
MD5 4a194671a0c90767e5b839a8c83585b3
SHA1 798b573e94237aa5c3509d6562ca5a0428002fff
SHA512 77990314e0b427e9de45f457ae31dd90332430af071b7ae7eec12e4aaaddbfc735cc8d9e680a584d45aec50d8c8217acd7e8d6378cb95075198ef1f6f278b3a0
SSDEEP 98304:B4TQzzJoDfuBcMv+A73XAZ/IJsiC5sop7cTg:BLzD+F2siC592Tg
TLSH
T182177D11FBEA80F5F56351308977D27BE735B8064A31DB9B8640DA1F6F33A904D2A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 18d8ba96ae22d5ee0e6de3c8afc0ac922de04f46ca25fe90db50640685251b62
MD5 113502c031d7b511d03e406a783904b0
SHA1 fcf74db7a5ee01629adc9ec3a92027a1a9296ebf
SHA512 f7f8d10b8d454a9f3819b7be2547d397ca4b8c2a9e245343f6d6ef7f2f601001da9bac4ae2cf903fa5cfe656d78712e83f3584e0f2f44f1f19a320a2d7a3f2c3
SSDEEP 96:oLFiZ13+gV4+gCRTgFiZ13nc4nfK0p+wX94+AHslaDuKvF+gg1f/4IQo+wevNn5w:NVpx4hwGv09Qn6Eo5Eo2I
TLSH
T1E5C1F625E16ADC63F223A8C7E629DFC64AD4B39B5D4C5A0462494618FBD8C33CD194F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 d7e74b90bccd80a8f4f8c82af82f4fe3ecb6012f9d13f8b566d8bf2dffbf931c
MD5 ae631e2213141c88e6ce588d32c29478
SHA1 d7d81d2007fc95a7c62b58161bd66b1e10f3b6bc
SHA512 9c8105f8d977b2bbb16be9a64b012b18c4f17505524ed78d48c6a2c36b2f9ffaf6911ea03ea2473403455777d7584888a53ee8d345a35248479aeaf4245e78ef
SSDEEP 96:oLFiZ13+gV4+gCRTgFiZ13nc4nfK0p+wX94+AHslaDuKvF+gg1f/4IQo+wevNn5A:NVpx4hwGv09Qn6Eo5Eo2n34
TLSH
T1B9D10725E16ADC63F223A8C7E629DFD24AD4739B5C4C5A0462494618FBD8C33CD194F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 a6700f25f7794f8a44e4c7a4d1f46702e2f2fa138089655fe35df6c06928d2f2
MD5 e8303db7025e14ce85e22f8bdaf7127a
SHA1 cbe75af47ce397ef1baacea41c86ed88e9499e01
SHA512 749e92bf456fdd642ee26103fca32fc00c305f2e71a66cdcafa765d48eddaa2004f88c249154bcf0cb8ceee84026d9e740b3373b5883dd249a7448b06e18b402
SSDEEP 96:oLFiZ13+gV4+gCRTgFiZ13nc4nfK0p+wX94+AHslaDuKvF+gg1f/4IQo+wevNn5J:NVpx4hwGv09Qn6Eo5Eo2n3XB
TLSH
T180D10625E16ADC63F233A8C7E629DFD24AE473AB5C4C5A0462494618FBD8C33CD194F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 44d57e34c48485ad586c5feb79d431d72e4a1cca18fdcd9ea4670d16160a425b
MD5 e8ebdb0e230e3be76795346749f123b5
SHA1 238b3cb9daf8d954dfcf97caa74b869afb16bad8
SHA512 663170823f7ad1edcc32df7f0a9085e467c0a872007224dcba8fdbb405a7c4ae9c7ad7a62fd1c010769c278955f758a939b629cf505d7c20b70b0c4fd5eae089
SSDEEP 96:oLFiZ13+gV4+gCRTgFiZ13nc4nfK0p+wX94+AHslaDuKvF+gg1f/4IQo+wevNn5c:NVpx4hwGv09Qn6Eo5Eo2n3X3y7
TLSH
T16AD1E525E16ADCA3F233A8C7E629DFD24AD473AB5D4C5A0462494618FBD8C33CD194F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 f74c72a3dba6ba45cd044dccede877bb578e15f0a74a0c20dc8c4948ae8b9373
MD5 2e950b98d65bb1f2e917225d3512e415
SHA1 0fb11058bd5c4d710f13934456626a262eb42684
SHA512 3a471132beec0ccd8657049a4312b886d2771d75b1bd9c9dfb76bb9a0cb84c65760def793aefef8eb5b3f52a6631b0b1d8297b63623477eb44099b8e1a058434
SSDEEP 96:oLFiZ13+gV4+gCRTgFiZ13nc4nfK0p+wX94+AHslaDuKvF+gg1f/4IQo+wevNn5B:NVpx4hwGv09Qn6Eo5Eo2n3X3yxQ
TLSH
T117E1E565E16ADCA3F233A8C7E629DFD24AD473AB5C4C5A0463494618FBD8C338D194F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 7KB
SHA256 04504778f61cb815ac3deabe0b5c2f927cdde700d722e1ced88e6c5b3bd5bf94
MD5 d8e99fe31b7e893da6b46c84a2e04f3e
SHA1 1048cf8887889e3fff475b35039390aed7b670f0
SHA512 a75b7919d6274984e32f443b5769979699a2f9f61362a3ba25862a02326b4deb541508e640b1d5afe22d88bf44a3801d7c070241da85059684482384b0733492
SSDEEP 96:oLFiZ13+gV4+gCRTgFiZ13nc4nfK0p+wX94+AHslaDuKvF+gg1f/4IQo+wevNn51:NVpx4hwGv09Qn6Eo5Eo2n3X3yxg57D
TLSH
T1CBF1E465E16ADC63F233A8C7E629DFD24AE473AB5C4C5A0462494618FBD8C33CD194F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 8KB
SHA256 5d10d1e6a23eb4a00b78451cd369298b890e1d55ae57c1763672631f285ffa06
MD5 e20a45fe9f4e9b991c46bf04ae80fe4a
SHA1 5e896e051afe152d1726707789cd8f5b9837ffe6
SHA512 c866ec9ad9bf08fce5641dc18f74af8aafea24cf740dc18e0c81c42fd87640d7b366c44bb21194d0c1dc6d1163a540c1029bbaa3faad2f4113ace51482f3b1a0
SSDEEP 192:NVpx4hwGv09Qn6Eo5Eo2n3X3yxg57CfgSE24TQ:Vx4hwGveQ6Eo5EoCH3yapagSE24E
TLSH
T13412D365E16ADC63E233A8C7E629DFD24AD873AB5C4C5A04624D4618FBDCC338D194F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 10KB
SHA256 a6414bd3484d153c317776ee8c05ade47c98f886c691a82a6168c3a55a37b570
MD5 592a31c8cd64f6738d39df422478325c
SHA1 2a9407ad6dd5e39d616e4d778b2521380899b64f
SHA512 b3890d989727b367090833ce86e6d8d00c4749a6112998be8afe78ce273b1830b7a01d823338e335a17a2cb02fd953b2b1b028cacce4d307bef49cef64cc1a83
SSDEEP 192:NVpx4hwGv09Qn6Eo5Eo2n3X3yxg57CfgSE24TqS7QDjEoGs:Vx4hwGveQ6Eo5EoCH3yapagSE24+S7Kd
TLSH
T1F322E365E16ADC63E233A8C7E629DFD24AD873AB5C4C5A04624D4618FBDCC338D194F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 10KB
SHA256 d816822ab4dc8c9257c05b93ae98423be45a9d001bd0c0bd097be3c7670e0133
MD5 9b53a9375c407a99fd239173993cec53
SHA1 269e1637435d45d297667c4b5ccb211431246d09
SHA512 4bb7f8a157a0f39e84130ce7d757a1a98429625d2334c0afa265990591fe278a8a3894b8b312ecde35c5b0315b8b08d9230d9f0010413e62099614032c5dedd9
SSDEEP 192:NVpx4hwGv09Qn6Eo5Eo2n3X3yxg57CfgSE24TqS7QDjEoGDBveB+0B+kLDjEoGs:Vx4hwGveQ6Eo5EoCH3yapagSE24+S7KN
TLSH
T18F32D365E16ADC63E233A8C7E629DFD24AE8739F5C4C5A0463498618F7D8C338D194F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 11KB
SHA256 ce4ca0e666edc11cb5fa6fc2efdd8672349032505097792595aeb679f9de64eb
MD5 d53e78afb6eff5a0f51f1d7a65b43b73
SHA1 a7d4057e7daeb94213dee7a31e00846c1a9d6507
SHA512 8f5b29d3b02d2b401a4781ee662c2a0a2166a69fb778147cee8f7d589dde2a68553b5c6e622160b6d025d2ae7787181537c909f61669cb197646ae94cb67253a
SSDEEP 192:NVpx4hwGv09Qn6Eo5Eo2n3X3yxg57CfgSE24TqS7QDjEoGDBveB+0B+kLDjEoGDl:Vx4hwGveQ6Eo5EoCH3yapagSE24+S7Kg
TLSH
T1F932F565E16ADC63E233A8C7E629DFD24AE8739F5C4C5A0463498618F7D8C338D194F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 11KB
SHA256 89893d2ea0c2c980d2706c3887d51c901aa15a741ca606de2736bdd8d999b899
MD5 1157a6771c3bea5e4eda549ded8acb15
SHA1 6bbad5d6a508e696c202cd8679e4e475d87e4c23
SHA512 c8f69d3db5e5ff85bad195d6bbc6ae718600e5fe94c94dbe97f8c1ac4a0212071f6b2045c22cca80f4e50a43361b8cd58f263d163db15c6e46f5265d560d9de7
SSDEEP 192:NVpx4hwGv09Qn6Eo5Eo2n3X3yxg57CfgSE24TqS7QDjEoGDBveB+0B+kLDjEoGDx:Vx4hwGveQ6Eo5EoCH3yapagSE24+S7Ks
TLSH
T1EC42E465E16ADC63E233A8C7E629DFD24AE8739F5C4C5A0463498618F7D8C338D194F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 48d60e44f469053dc1a9289bd65ddd8fdfaf7e3dec1bce6162b89aef31907c28
MD5 1865fa9f675cf607454d5943b70d42a0
SHA1 562810572fa266f07d440ae7a748b1b22d9e5eda
SHA512 3d814131349127d40afb6aa62eb5cc0e87051116df20af3610bb8fe913702b1a6db41f1910242c68c748434933bf0cfcfe5feef844786aff04814457fa5e449a
SSDEEP 384:Vx4hwGveQ6Eo5EoCH3yapagSE24+S7KEo5BlBtDEodBkg+MhX:Vx4X23Eo5EoCHTYgSE2NrEo5BlBtDEoh
TLSH
T1E842E465E16ADC63E233A8C7E629DFD24AE8739B5C4C5A04634D8618F7D8C338D194F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 91da07c98b8054f530e39992b8b2d13beb63feacc931a4500503ceb4e20bc8de
MD5 ec9369942dcac14b6a27628207d8c91b
SHA1 0ab0aff7850f31f848080b8803a5f6005c8123e6
SHA512 618fc286e120e0ba2163ecd24ae4cc6965429cf0140da4c5e967222d9ff5d8aa03a7904ad5887b9cacc786dbff4f63da390fdc81a2d3f5d6219a1e14ee23d923
SSDEEP 384:Vx4hwGveQ6Eo5EoCH3yapagSE24+S7KEo5BlBtDEodBkg+MhZ0:Vx4X23Eo5EoCHTYgSE2NrEo5BlBtDEoA
TLSH
T1F842E465E16ADC63E233A8C7E629DFD24AE8739B5C4C5A0463498618F7D8C338D194F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 13KB
SHA256 d50eb7a698e2d3b02a6249240411ca6d9872e592aba112b529473677c98abc69
MD5 8a29ad629a10e972f8bd6517b0558654
SHA1 4e8d47c6b9afddde3b7113c1d193c9ad9744f6d2
SHA512 6ff75bb9fc2c1786324814f41e6061f769185a231fbe2f55e15347049e6c9ce9b2bc79bbbdecaf7b82c11a0e2ac257b0ebb5e9ac9b4bbe436a27fdd23a4abcb2
SSDEEP 384:Vx4hwGveQ6Eo5EoCH3yapagSE24+S7KEo5BlBtDEodBkg+MhZEN:Vx4X23Eo5EoCHTYgSE2NrEo5BlBtDEog
TLSH
T16B52E465E16ADC63E233A8C7E629DFD24AE8739B5C4C5A0463498618F7D8C338D194F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 13KB
SHA256 28633d108a2bca7eb30770173eed00b00a04b4e0451b8e7e4704e557c596df1a
MD5 9f20a11eda9942de5ba5b3a7d71c7475
SHA1 736670f67100c8959dfc1c956582742094e6b92c
SHA512 bd7b03b5d6366f7a303f8117d6b2551ff7acb2e7602ff7c48772517510074ed3bd630ba3deac52b4fbfdb07749067431b561f430bb19cf51d1eeeab2f4c41dd1
SSDEEP 384:Vx4hwGveQ6Eo5EoCH3yapagSE24+S7KEo5BlBtDEodBkg+MhZEh1:Vx4X23Eo5EoCHTYgSE2NrEo5BlBtDEoA
TLSH
T19C52E565E16ADC63E233A8C7E629DFD24AD8739B5C8C5A04624D8618F7D8C338D194F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 7c236d8a29d2b8efbc89807741a0268a4b1ae938219224660e722f6346a2083a
MD5 56ccab010dcd7533dddf9cfbfaa0a0ae
SHA1 5e2732f96b57d401bc4d3b314993fd8a1eabf0e8
SHA512 88957ca243ecdddea2780ab4f244c34830add2f17b067e9f570f5f6a50662eb4a9c93b7e791ad65eed86e966e1629046976d672bec709bc3eceac951cc7319e4
SSDEEP 384:Vx4hwGveQ6Eo5EoCH3yapagSE24+S7KEo5BlBtDEodBkg+MhZEhad:Vx4X23Eo5EoCHTYgSE2NrEo5BlBtDEo5
TLSH
T1ED52E565E16ADC63E233A8C7E629DFD24AD873AF5C8C5A04624D8618F7D8C338D194F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 ae605b3532a2b8bce45b90d4bdd847927b2907caa1f67b26a57f5601b958fc67
MD5 fdcc59025b5623e3e773481a7bef7966
SHA1 bbfec8ec75cd4c60cdc994f771f22b395b1a98d1
SHA512 b05eb8ab4dd81e108ace9eb35878aec9d35fd691f83f9c622e54438bdcc46c4065b7f689c96c67a678613bbc711e078483662b6f7a8e70169fd7aae219dc610b
SSDEEP 384:Vx4hwGveQ6Eo5EoCH3yapagSE24+S7KEo5BlBtDEodBkg+MhZEhafD:Vx4X23Eo5EoCHTYgSE2NrEo5BlBtDEoX
TLSH
T1AE52D565E16ADC63E233A8C7E629DFD24AD873AF5C8C5A04624D8618F7D8C338D194F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 a847526e2848c47df7af8ba377e2636bb6c280303d0b4a141f42ec759c39f970
MD5 45945d82429555232fa64b8df90fc31f
SHA1 3be1109b3e282247990a4770f6951c219b1e9a22
SHA512 4afdab0d00cb1bb30064b8652b700cae88c838286196c9e8fef8c13669f7811373a183ff35a972d97e7cf2879f93fcc151160c9dd785a6ee6f31534bf6fbf0c9
SSDEEP 384:Vx4hwGveQ6Eo5EoCH3yapagSE24+S7KEo5BlBtDEodBkg+MhZEhafxB:Vx4X23Eo5EoCHTYgSE2NrEo5BlBtDEo/
TLSH
T11E62D565E16ADC63E233A8C7E629DFD24AD873AF5C8C5A04624D8618F7D8C338D194F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 22252a8ff705c31d6573490ca58a667eb13ad2e666aa5c346976f73ef46b9308
MD5 168edaba9d6b66b749d44f104d9b7406
SHA1 605061485fd2b5feca976e0f711227cdad74ff76
SHA512 6e4b7b03394fe8db4beaef2bc3673a4e6860e1cd34e9a639e64db974efc9daa6e79a250dfecfd7bd99a9b490c5b18ee3849764ad586cd584fbb44bf7e451b331
SSDEEP 384:Vx4hwGveQ6Eo5EoCH3yapagSE24+S7KEo5BlBtDEodBkg+MhZEhafxg:Vx4X23Eo5EoCHTYgSE2NrEo5BlBtDEom
TLSH
T13D62E565E16ADC63E233A8C7E629DFD24AD873AB5C8C5A04634D8618F7D8C338D194F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ebee0b7835a232962685e49744ee7d74fc4149a6818e48c34f9e786427114894
MD5 ef0fac591dc2b55b44ae628f2a7f63f6
SHA1 5b5a32569c4b05adb1733641cd06482206cfadec
SHA512 6d81e8c0cc840218b0358be912fcbae16626b707ab6ae82b6c15bf11e38715c6ba0702a66cdb0396c38ab0f2e814bc8dffe6c3241d88b2eb933a5c0b66dbbd6b
TLSH
T1E911F694E57B88A3A03264C7E62ACFD349E873AF1C5C5A0522894119E798C328D0CCF2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 16KB
SHA256 8042faa128fdbb284d2def52d55764f3cd666a1ab6680dfb50c46dcdb15e94d2
MD5 83f41ba9b21ae135a68ea66cc4027859
SHA1 769b76c89179e5ef36f12c6292d7c5678efb2a15
SHA512 537402d1b6b4e1a8f8c63e9946f4c53f079a58d64566281781191453bf9ee704bd26fb1c4c685533013da06a2cec512e41afee92b842e6f9d8595486f896764e
SSDEEP 384:Vx4hwGveQ6Eo5EoCH3yapagSE24+S7KEo5BlBtDEodBkg+MhZEhafx9:Vx4X23Eo5EoCHTYgSE2NrEo5BlBtDEo3
TLSH
T18C72F765E16ADC63E233A8C7E62DDFD24AE8739B5C8C5A04624D8218F7D9C338D194F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 16KB
SHA256 f442cfcb809157664201fe9dadbf9b182d7192a0ad8e746a7cf14388de2a6f23
MD5 7438ef122e7d43dd1c6cf7fbe4ec87f2
SHA1 1f4b3128109ed2a7da509af33944fcbc492fde72
SHA512 5ca4dfa8dac01238b5aa2630dd3fc8b81a5b9e91dce235fd77553ed9c015165cdf2e2d35368518021ef7c8b53604eb5d42bf8323f12c76326cc3b7328a054ceb
SSDEEP 384:Vx4hwGveQ6Eo5EoCH3yapagSE24+S7KEo5BlBtDEodBkg+MhZEhafxagms:Vx4X23Eo5EoCHTYgSE2NrEo5BlBtDEoZ
TLSH
T14D72E865E16ADC63E23368CBE629DFD24AE8739B5C8C5A0462498218F7D9C338D194F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 18KB
SHA256 0ad1d9ffdc34990f2ca50d2a2516eab488e02e32ac81f21ef36c177799a8520e
MD5 4002a5cac3777335e8ccf646f1c411b5
SHA1 691de939b1051ef4d33c70f7bdfccd285ebdbbac
SHA512 f060aacdb6de14a94fd0e583e91b62353eb89dae062f4d56b5c985508db9aeb98ed56464e6d30a102884d70f6231f09ec7819a084803bf425444746c2cb29434
SSDEEP 384:Vx4hwGveQ6Eo5EoCH3yapagSE24+S7KEo5BlBtDEodBkg+MhZEhafxagmgD:Vx4X23Eo5EoCHTYgSE2NrEo5BlBtDEoX
TLSH
T1ED82F565E16ADC63E23368CBE62DDFD24AE8739B5C8C5A0463498218F7D9C338D194F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 3851d120daba2ae83b3ab678098fd8c8b8a1adfdfc57232a3e759ec3480e257d
MD5 01e985abc39730d7ec5a5f4a8abc1563
SHA1 8e7ff488afca694b181d2fe98934633b894d9680
SHA512 3fa0e7f099ac688ffa75aa24f21740ab75d2dd2d0320d09efbc837198e34363c2ce242362012a2922138cda1085b2a303451a8b5976fb96a5e56927429a2bd77
TLSH
T15131FD54A57BD8A3E13268C7E52ACFD34AE477AF6C5C5B0922994119E788C328C1DCF2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 f4adeda62f37a1dee1eb4a338cf1df765a2ce8e3ce46f5084568c97e22062ca5
MD5 b72bc54adf9ec35fae8d0b02e50fa154
SHA1 bf15aacc7c671aa45ee5800ef1b111517049dedd
SHA512 95a86f574633f51644735b613a050837788e309576e5297b5f21e820aec7630fe7f38e088a62bf1faa0615cc1f8ec47cb9c22cb781dd3aea8093bc519cbd6e0e
TLSH
T1D241E965E17BD8A3E233A8C7E529CFD24AE473AF5C4C5A0522994219E7D8C338C1D8F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 34661f86c5631b89b6c5c8947da8cd633fdfe26ee5c9b0a970669635a8377560
MD5 3976bb749c9455e1b69194fbd7999215
SHA1 7db457fb1ae8ef70bdc08ca3ca20dde578da9056
SHA512 9a2a3d13ef7bfc4f21378f43baf90f838bff85986103a0c053bc5ba5c4ffee608da01d3e725fd6e2eccc26125aab0be60b98c3e93f8bf789095103f8cc376dbb
TLSH
T14441E965E17ADCA3E233A8C7E629DFD24AD473AF5C8C560562994119EBD8C338C0D8F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 9a4c637868da0ab1622eca027100b67198182117964261cbe32cadc02682dbdd
MD5 22491b1c9e95e1f5c4ecc6ae2cfbf9c0
SHA1 b35314067f16ceb3f5ea402de222a245af4a1c26
SHA512 f1fba379e5c1f52a86ceb317d9d4a68a3d66a35fe1506f5bf9ba726e5ef26fd4502458f886edd7d6ccb1651994b092c0c564f6eefb06b77561e8047dc86c0bfc
TLSH
T172613A15D1AFDC63A222A4C7F629DFC68AD4B3AB5D481A0463894515FBD8C33CD198F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 7b10c5429180c118669aaf29ff26e8b18487147dc079ef2135bee0f571643b18
MD5 042b2f8403bb084e259db5eee0a49a6f
SHA1 d72f8d8a11d00764ea2f9fae9ca446f717ebaf87
SHA512 695c664abcecc5c206e2e2e0976bb8b6e2d8e8a503f977cc5088cda43dfdf9d0c88a43393a835d0bc2a6e2d5cae6e0531132f86bf37b2921965f8d6f6bf1dcc2
TLSH
T1A9614C15D1AFDC63A222A4C7F629DFC68AE4B3AB5D481A0463894515FBD8C33CD198F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 60f3fbb8996f6498cbcd45ddaff6cdf2f22cc854cb4783b589e16126a56ad424
MD5 e84864ed9d0a1cf88a2efe2810e3f181
SHA1 1a58605345d1db851bdbb413c263900111b16a5e
SHA512 7c0c0074023f3221aaff046896157d0d081b5e1c195fdc9e80656c27227841b7bef1afdce54efc409c2561ed027ded1efe1be5d26bbba94d1363d5bfe687b357
SSDEEP 96:oLFiZ13+gV4+gCRTgFiZ13nc4nfK0p+wX94+AHslaDuKvF+gg1f/4IQo+wevNn5Q:NVpx4hwGv09QnQ
TLSH
T19D910825E16EDC63B223A8C7F529DFD64AD473AB5D4C1A0462894614FBD8C33CD198F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/848-348-0x0000000000C50000-0x0000000000C72000-memory.dmp

Download

memory/1232-1079-0x0000000000B10000-0x0000000000B32000-memory.dmp

Download

memory/1556-770-0x0000000000110000-0x0000000000132000-memory.dmp

Download

memory/1556-430-0x0000000000110000-0x0000000000132000-memory.dmp

Download

memory/1664-241-0x0000000000320000-0x0000000000342000-memory.dmp

Download

memory/1664-142-0x0000000000320000-0x0000000000342000-memory.dmp

Download

memory/1852-1023-0x0000000000C30000-0x0000000000C52000-memory.dmp

Download

memory/2484-82-0x00000000002B0000-0x00000000002D2000-memory.dmp

Download

memory/2484-14-0x00000000002B0000-0x00000000002D2000-memory.dmp

Download

memory/2624-679-0x0000000000260000-0x0000000000282000-memory.dmp

Download

memory/2804-535-0x00000000001F0000-0x0000000000212000-memory.dmp

Download

memory/2908-0-0x0000000000B80000-0x0000000000BA2000-memory.dmp

Download

memory/2908-9-0x0000000000B80000-0x0000000000BA2000-memory.dmp

Download

memory/3036-121-0x0000000000330000-0x0000000000352000-memory.dmp

Download

memory/3180-429-0x00000000004A0000-0x00000000004C2000-memory.dmp

Download

memory/3180-177-0x00000000004A0000-0x00000000004C2000-memory.dmp

Download

memory/3464-254-0x00000000000C0000-0x00000000000E2000-memory.dmp

Download

memory/3488-253-0x00000000000C0000-0x00000000000E2000-memory.dmp

Download

memory/3540-1081-0x0000000000B10000-0x0000000000B32000-memory.dmp

Download

memory/3636-534-0x00000000007A0000-0x00000000007C2000-memory.dmp

Download

memory/3832-775-0x0000000000110000-0x0000000000132000-memory.dmp

Download

memory/3832-431-0x0000000000110000-0x0000000000132000-memory.dmp

Download

memory/4456-255-0x0000000000360000-0x0000000000382000-memory.dmp

Download

memory/4456-404-0x0000000000360000-0x0000000000382000-memory.dmp

Download

memory/4500-63-0x00000000002B0000-0x00000000002D2000-memory.dmp

Download

memory/4500-15-0x00000000002B0000-0x00000000002D2000-memory.dmp

Download

memory/4532-402-0x0000000000B00000-0x0000000000B22000-memory.dmp

Download

memory/4616-171-0x0000000000740000-0x0000000000762000-memory.dmp

Download

memory/4616-250-0x0000000000740000-0x0000000000762000-memory.dmp

Download

memory/4704-930-0x0000000000890000-0x00000000008B2000-memory.dmp

Download

memory/4748-349-0x0000000000C50000-0x0000000000C72000-memory.dmp

Download

memory/4848-483-0x00000000007A0000-0x00000000007C2000-memory.dmp

Download

memory/4860-1053-0x0000000000BE0000-0x0000000000C02000-memory.dmp

Download

memory/4860-1022-0x0000000000BE0000-0x0000000000C02000-memory.dmp

Download

memory/4988-346-0x00000000000B0000-0x00000000000D2000-memory.dmp

Download

memory/5028-1024-0x0000000000C30000-0x0000000000C52000-memory.dmp

Download

memory/5180-172-0x0000000000740000-0x0000000000762000-memory.dmp

Download

memory/5180-251-0x0000000000740000-0x0000000000762000-memory.dmp

Download

memory/5336-401-0x0000000000B00000-0x0000000000B22000-memory.dmp

Download

memory/5500-256-0x0000000000360000-0x0000000000382000-memory.dmp

Download

memory/5500-405-0x0000000000360000-0x0000000000382000-memory.dmp

Download

memory/5504-347-0x00000000000B0000-0x00000000000D2000-memory.dmp

Download

memory/5596-141-0x0000000000EF0000-0x0000000000F12000-memory.dmp

Download

memory/5608-122-0x0000000000250000-0x0000000000272000-memory.dmp

Download

memory/5724-536-0x0000000000060000-0x0000000000082000-memory.dmp

Download

memory/5900-153-0x0000000000320000-0x0000000000342000-memory.dmp

Download

memory/5900-242-0x0000000000320000-0x0000000000342000-memory.dmp

Download

memory/5972-929-0x0000000000890000-0x00000000008B2000-memory.dmp

Download

memory/6096-123-0x0000000000250000-0x0000000000272000-memory.dmp

Download

memory/6212-680-0x0000000000060000-0x0000000000082000-memory.dmp

Download

memory/6352-998-0x0000000000ED0000-0x0000000000EF2000-memory.dmp

Download

memory/6436-997-0x0000000000ED0000-0x0000000000EF2000-memory.dmp

Download

memory/6608-713-0x00000000001F0000-0x0000000000212000-memory.dmp

Download

memory/6724-779-0x0000000000260000-0x0000000000282000-memory.dmp

Download

memory/6852-817-0x00000000008B0000-0x00000000008D2000-memory.dmp

Download

memory/6872-818-0x00000000008B0000-0x00000000008D2000-memory.dmp

Download

memory/6900-819-0x0000000000790000-0x00000000007B2000-memory.dmp

Download

memory/7128-928-0x0000000000790000-0x00000000007B2000-memory.dmp

Download

memory/7204-1262-0x0000000000B10000-0x0000000000B32000-memory.dmp

Download

memory/7224-1164-0x0000000000D90000-0x0000000000DB2000-memory.dmp

Download

memory/7336-1194-0x0000000000F40000-0x0000000000F62000-memory.dmp

Download

memory/7888-1239-0x00000000008F0000-0x0000000000912000-memory.dmp

Download

memory/8124-1253-0x0000000000DB0000-0x0000000000DD2000-memory.dmp

Download

memory/8160-1254-0x0000000000DB0000-0x0000000000DD2000-memory.dmp

Download