6b8a9dce71b56b83bdf839cfb1308edbfd14c2dbd716b08f25112b661f8f0f6d

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_040ccf64e773fdc5ca42132d2b9bd264_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
Size 18.7MB
Sample260716-asdenacy61
SHA256 6b8a9dce71b56b83bdf839cfb1308edbfd14c2dbd716b08f25112b661f8f0f6d
MD5 040ccf64e773fdc5ca42132d2b9bd264
SHA1 b3a65438c2406811510d52236db9d00d199bce55
SHA512 6bcdd867bed9930ea90866eebefb9acb0c156b09f6e17b739058293351f7646f4d3bcfd3a3ad665416cb9c78acbc2da1b60eebb4a5536caf1898c5478797c09a
SSDEEP 98304:j4TQzzJoDfuBcMv+A73XAZ/IJsiC5sop7cTg:jLzD+F2siC592Tg
TLSH
T1BC177D11FBEA80F5F56351308977927BF735B8064A31DB9B8640DA1F6F33A904D2A326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001c66f-10.dat	INDICATOR_EXE_Packed_Fody

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	2026-07-15_040ccf64e773fdc5ca42132d2b9bd264_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe

Executes dropped EXE 47 IoCs

pid	Process
4432	svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe
3276	svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe
3496	svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe
5776	svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe
2648	svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe
5480	svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe
4664	svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe
3096	svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe
1324	svchost_ABCABCBBBCACCBABACBBCCBACBBCCCCCACBBBACAAABBBBCBCAACCBB.exe
1340	svchost_ABCABCBBBCACCBABACBBCCBACBBCCCCCACBBBACAAABBBBCBCAACCBB.exe
3224	svchost_ABCACCABCBBACBCAABCACACBBBAACABCBCCACBACABBBCBBBCCBBCBA.exe
5584	svchost_ABCACCABCBBACBCAABCACACBBBAACABCBCCACBACABBBCBBBCCBBCBA.exe
3192	svchost_AACBABAACBACBCBCBCAABBABABABCBBBBBAAAAAABBCBABACACCBCBA.exe
5160	svchost_AACBABAACBACBCBCBCAABBABABABCBBBBBAAAAAABBCBABACACCBCBA.exe
1084	svchost_BACBCCBCCCAAABCAACAACAABCBCCCBBCAACCCBCCBACCABBBCACCBAA.exe
4320	svchost_BACBCCBCCCAAABCAACAACAABCBCCCBBCAACCCBCCBACCABBBCACCBAA.exe
6116	svchost_CCCABCBCBACAABCABCCCACABCACBBABABABBBBCCABABCACAAACCBCB.exe
6400	svchost_CCCABCBCBACAABCABCCCACABCACBBABABABBBBCCABABCACAAACCBCB.exe
5700	svchost_BACCBACAABBABABBBCABABBBBACBCCBBCBACAACCCAABCACAACACABB.exe
6176	svchost_BACCBACAABBABABBBCABABBBBACBCCBBCBACAACCCAABCACAACACABB.exe
6352	svchost_ABCBACBBACCABCACCBABBAABCBABCBCCBACAABCABBBBABABBCCCBAA.exe
1944	svchost_ABCBACBBACCABCACCBABBAABCBABCBCCBACAABCABBBBABABBCCCBAA.exe
4140	svchost_BCCACABBBABCABBCBACBAACCAAABACCCAACACCACCCBBCACCCCABBAA.exe
1492	svchost_BABCCBBBBABBACCBBCACCBACCABCCBABACBACCCACCCBCACCACCBCBA.exe
4896	svchost_BABCCBBBBABBACCBBCACCBACCABCCBABACBACCCACCCBCACCACCBCBA.exe
1616	svchost_AACCAABACBBCCAABAAAACACCABAACBAAABCABCAAABACAABABABCBBB.exe
1372	svchost_AACCAABACBBCCAABAAAACACCABAACBAAABCABCAAABACAABABABCBBB.exe
1444	svchost_CCACAABCBCBCABCBABBACAAACCCBBCBCBACBABACCBCAACABCBBBCAA.exe
3512	svchost_ABBACBABBCBCAACABCCCACCCACCABBBCCAACBBCCABACCCACCBABCCA.exe
4240	svchost_ABBACBABBCBCAACABCCCACCCACCABBBCCAACBBCCABACCCACCBABCCA.exe
4440	svchost_CCACAABCBCBCABCBABBACAAACCCBBCBCBACBABACCBCAACABCBBBCAA.exe
568	svchost_CABCABBACCCBBAABBCCCCCCAABBCBAAAAACBBBAABCBAACABABACBCB.exe
4960	svchost_CABCABBACCCBBAABBCCCCCCAABBCBAAAAACBBBAABCBAACABABACBCB.exe
4372	svchost_CBCABCCCCCACABAAABABCACAAACBCACCACCBBACAABBCCACBBCACABA.exe
1404	svchost_BCCCCBACBBCCBABCAABAABAAAAACCABBABACBBBBCBBAABCAACBACBC.exe
6544	svchost_BCCCCBACBBCCBABCAABAABAAAAACCABBABACBBBBCBBAABCAACBACBC.exe
4720	svchost_BBCBCAACCAAAAAAAABBCACCBBACCACBBAAACBBCBBCABCCAAACBAABB.exe
1708	svchost_BBCBCAACCAAAAAAAABBCACCBBACCACBBAAACBBCBBCABCCAAACBAABB.exe
3888	svchost_ACCCBBABBAABCCABCACCCAACACAABABABACCCBCCACBBCBAAACCBBBA.exe
7092	svchost_ACCCBBABBAABCCABCACCCAACACAABABABACCCBCCACBBCBAAACCBBBA.exe
4128	svchost_ACBBABCBBABCABACBCBAACCBABBBCBCABCBCBBCBCBCCACAACAAACAC.exe
5768	svchost_ACBBABCBBABCABACBCBAACCBABBBCBCABCBCBBCBCBCCACAACAAACAC.exe
4708	svchost_BBBBABBACACCBACACABACCCBACBABBCAACCACACBCCBCCACBBABCBAB.exe
2252	svchost_ACBABAACABBABACBCCCBABBACBBCCCBBAABCBBBAABBABBBACBACBCA.exe
4500	svchost_ACBABAACABBABACBCCCBABBACBBCCCBBAABCBBBAABBABBBACBACBCA.exe
7176	svchost_ABACBCBAAAACBABBCAAACABCCCAABBACCBAAABCACCBABCBBABBBBCA.exe
5452	svchost_ABACBCBAAAACBABBCAAACABCCCAABBACCBAAABCACCBABCBBABBBBCA.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAABBBCABCBBAAAABACAACABACBBBBCBBBCBAACAACACBCBBBBAAACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe"	2026-07-15_040ccf64e773fdc5ca42132d2b9bd264_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBCCBCBABCABCCAAACACBABAACBBCCACCCABBCAACBBACAACCBCABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe"	svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBCCABBCBBCCAAAACCBCBCBCCACBBACBCABABAABABCCABCCCCCCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCCBBBBABBACCBBCACCBACCABCCBABACBACCCACCCBCACCACCBCBA.exe"	svchost_AACBABAACBACBCBCBCAABBABABABCBBBBBAAAAAABBCBABACACCBCBA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCCBABBBBCCBBCBBBBBCBABABCBACCAAABBCCABAABBACAACCBACBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACAABCBCBCABCBABBACAAACCCBBCBCBACBABACCBCAACABCBBBCAA.exe"	svchost_CCCABCBCBACAABCABCCCACABCACBBABABABBBBCCABABCACAAACCBCB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACACACACBCBAACBACBAAACCCCCABABAABACAAACCBAACCBACCCBCCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCCBACBBCCBABCAABAABAAAAACCABBABACBBBBCBBAABCAACBACBC.exe"	svchost_BACCBACAABBABABBBCABABBBBACBCCBBCBACAACCCAABCACAACACABB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBABBBAABAACCACCABCCAAAABCBCBCBACBACBBBBACCACCBAABBBBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBCAACCAAAAAAAABBCACCBBACCACBBAAACBBCBBCABCCAAACBAABB.exe"	svchost_CCACAABCBCBCABCBABBACAAACCCBBCBCBACBABACCBCAACABCBBBCAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABACAABCCBAABBBCAAAABACAABCACACCCAAACBBCABBBCBCAAACABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACBCBAAAACBABBCAAACABCCCAABBACCBAAABCACCBABCBBABBBBCA.exe"	svchost_ABCBACBBACCABCACCBABBAABCBABCBCCBACAABCABBBBABABBCCCBAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBBABABACABCBCBBCABACAACAAABBBAAAACABAACCBCACCACCACCCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe"	svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCACCABCBBACBCAABCACACBBBAACABCBCCACBACABBBCBBBCCBBCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCABCBBBCACCBABACBBCCBACBBCCCCCACBBBACAAABBBBCBCAACCBB.exe"	svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAAACAABBCABCABBAABABCBABBCCCAACBCBBCBBBBCBCBBCABCBAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBCCBCCCAAABCAACAACAABCBCCCBBCAACCCBCCBACCABBBCACCBAA.exe"	svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACCBACAABBABABBBCABABBBBACBCCBBCBACAACCCAABCACAACACABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACCBACAABBABABBBCABABBBBACBCCBBCBACAACCCAABCACAACACABB.exe"	svchost_ABCABCBBBCACCBABACBBCCBACBBCCCCCACBBBACAAABBBBCBCAACCBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCCCBCBCACCCACCABBBABABCAAACBCBCAABCBAABCABCCBBBCBCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBACBABBCBCAACABCCCACCCACCABBBCCAACBBCCABACCCACCBABCCA.exe"	svchost_ABCACCABCBBACBCAABCACACBBBAACABCBCCACBACABBBCBBBCCBBCBA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAACACCABCBBAACCCAAAAAABACBCABCCCCCBBACABBAABBBACABCCBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCBBABBAABCCABCACCCAACACAABABABACCCBCCACBBCBAAACCBBBA.exe"	svchost_ABBACBABBCBCAACABCCCACCCACCABBBCCAACBBCCABACCCACCBABCCA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAACACBAABCAACCAABBCBCCCBACCBCBACCBCCBCBCCCABABBCACBCAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBABBBBCACBBBCBBCAAAAABCCCCCABABAAABCBCCBCBBACCACAABBA.exe"	svchost_BACBCCBCCCAAABCAACAACAABCBCCCBBCAACCCBCCBACCABBBCACCBAA.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
11000	sc.exe
4588	sc.exe
7104	sc.exe
6016	sc.exe
9296	sc.exe
1060	sc.exe
6992	sc.exe
8120	sc.exe
6152	sc.exe
7448	sc.exe
1528	sc.exe
9948	sc.exe
5392	sc.exe
10856	sc.exe
7572	sc.exe
12048	sc.exe
8736	sc.exe
6764	sc.exe
420	sc.exe
1264	sc.exe
10352	sc.exe
5472	sc.exe
1140	sc.exe
7364	sc.exe
9888	sc.exe
12992	sc.exe
7240	sc.exe
7712	sc.exe
4752	sc.exe
2944	sc.exe
8560	sc.exe
8680	sc.exe
9732	sc.exe
5080	sc.exe
10408	sc.exe
10736	sc.exe
4600	sc.exe
12460	sc.exe
7916	sc.exe
11096	sc.exe
11108	sc.exe
7112	sc.exe
6624	sc.exe
240	sc.exe
4712	sc.exe
3464	sc.exe
13068	sc.exe
3196	sc.exe
3384	sc.exe
11476	sc.exe
12856	sc.exe
11436	sc.exe
8940	sc.exe
4844	sc.exe
8016	sc.exe
8568	sc.exe
12800	sc.exe
7992	sc.exe
9484	sc.exe
12912	sc.exe
12020	sc.exe
9200	sc.exe
9884	sc.exe
2372	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCACCABCBBACBCAABCACACBBBAACABCBCCACBACABBBCBBBCCBBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCABCBCBACAABCABCCCACABCACBBABABABBBBCCABABCACAAACCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBACBBACCABCACCBABBAABCBABCBCCBACAABCABBBBABABBCCCBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACAABCBCBCABCBABBACAAACCCBBCBCBACBABACCBCAACABCBBBCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_040ccf64e773fdc5ca42132d2b9bd264_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACCBACAABBABABBBCABABBBBACBCCBBCBACAACCCAABCACAACACABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCABCBCBACAABCABCCCACABCACBBABABABBBBCCABABCACAAACCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACAABCBCBCABCBABBACAAACCCBBCBCBACBABACCBCAACABCBBBCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
7964	schtasks.exe
9176	schtasks.exe
11992	schtasks.exe
12128	schtasks.exe
13408	schtasks.exe
4336	schtasks.exe
9196	schtasks.exe
10364	schtasks.exe
4440	schtasks.exe
5724	schtasks.exe
9816	schtasks.exe
10696	schtasks.exe
6808	schtasks.exe
3484	schtasks.exe
11380	schtasks.exe
12944	schtasks.exe
6692	schtasks.exe
7840	schtasks.exe
7152	schtasks.exe
11380	schtasks.exe
6252	schtasks.exe
7864	schtasks.exe
10340	schtasks.exe
12244	schtasks.exe
11872	schtasks.exe
5312	schtasks.exe
5972	schtasks.exe
4872	schtasks.exe
4580	schtasks.exe
11792	schtasks.exe
6180	schtasks.exe
6748	schtasks.exe
616	schtasks.exe
2712	schtasks.exe
7216	schtasks.exe
8000	schtasks.exe
9244	schtasks.exe
9132	schtasks.exe
3572	schtasks.exe
9484	schtasks.exe
7372	schtasks.exe
11732	schtasks.exe
12120	schtasks.exe
256	schtasks.exe
8948	schtasks.exe
7232	schtasks.exe
12452	schtasks.exe
7804	schtasks.exe
8016	schtasks.exe
6792	schtasks.exe
4912	schtasks.exe
8908	schtasks.exe
6560	schtasks.exe
3132	schtasks.exe
6224	schtasks.exe
12432	schtasks.exe
13256	schtasks.exe
5964	schtasks.exe
3240	schtasks.exe
2096	schtasks.exe
12884	schtasks.exe
11804	schtasks.exe
12164	schtasks.exe
7984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
4532	2026-07-15_040ccf64e773fdc5ca42132d2b9bd264_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
4532	2026-07-15_040ccf64e773fdc5ca42132d2b9bd264_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
4432	svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe
4432	svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe
3276	svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe
3276	svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe
4532	2026-07-15_040ccf64e773fdc5ca42132d2b9bd264_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
4532	2026-07-15_040ccf64e773fdc5ca42132d2b9bd264_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
2648	svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe
2648	svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe
3496	svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe
3496	svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe
5776	svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe
5776	svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe
5480	svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe
5480	svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe
3276	svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe
3276	svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe
4664	svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe
4664	svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe
3096	svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe
3096	svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe
1324	svchost_ABCABCBBBCACCBABACBBCCBACBBCCCCCACBBBACAAABBBBCBCAACCBB.exe
1324	svchost_ABCABCBBBCACCBABACBBCCBACBBCCCCCACBBBACAAABBBBCBCAACCBB.exe
3192	svchost_AACBABAACBACBCBCBCAABBABABABCBBBBBAAAAAABBCBABACACCBCBA.exe
3192	svchost_AACBABAACBACBCBCBCAABBABABABCBBBBBAAAAAABBCBABACACCBCBA.exe
1340	svchost_ABCABCBBBCACCBABACBBCCBACBBCCCCCACBBBACAAABBBBCBCAACCBB.exe
1340	svchost_ABCABCBBBCACCBABACBBCCBACBBCCCCCACBBBACAAABBBBCBCAACCBB.exe
5160	svchost_AACBABAACBACBCBCBCAABBABABABCBBBBBAAAAAABBCBABACACCBCBA.exe
5160	svchost_AACBABAACBACBCBCBCAABBABABABCBBBBBAAAAAABBCBABACACCBCBA.exe
3224	svchost_ABCACCABCBBACBCAABCACACBBBAACABCBCCACBACABBBCBBBCCBBCBA.exe
3224	svchost_ABCACCABCBBACBCAABCACACBBBAACABCBCCACBACABBBCBBBCCBBCBA.exe
5584	svchost_ABCACCABCBBACBCAABCACACBBBAACABCBCCACBACABBBCBBBCCBBCBA.exe
5584	svchost_ABCACCABCBBACBCAABCACACBBBAACABCBCCACBACABBBCBBBCCBBCBA.exe
2648	svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe
2648	svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe
6400	svchost_CCCABCBCBACAABCABCCCACABCACBBABABABBBBCCABABCACAAACCBCB.exe
6400	svchost_CCCABCBCBACAABCABCCCACABCACBBABABABBBBCCABABCACAAACCBCB.exe
6116	svchost_CCCABCBCBACAABCABCCCACABCACBBABABABBBBCCABABCACAAACCBCB.exe
6116	svchost_CCCABCBCBACAABCABCCCACABCACBBABABABBBBCCABABCACAAACCBCB.exe
5776	svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe
5776	svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe
5700	svchost_BACCBACAABBABABBBCABABBBBACBCCBBCBACAACCCAABCACAACACABB.exe
5700	svchost_BACCBACAABBABABBBCABABBBBACBCCBBCBACAACCCAABCACAACACABB.exe
6176	svchost_BACCBACAABBABABBBCABABBBBACBCCBBCBACAACCCAABCACAACACABB.exe
6176	svchost_BACCBACAABBABABBBCABABBBBACBCCBBCBACAACCCAABCACAACACABB.exe
1444	svchost_CCACAABCBCBCABCBABBACAAACCCBBCBCBACBABACCBCAACABCBBBCAA.exe
1444	svchost_CCACAABCBCBCABCBABBACAAACCCBBCBCBACBABACCBCAACABCBBBCAA.exe
3512	svchost_ABBACBABBCBCAACABCCCACCCACCABBBCCAACBBCCABACCCACCBABCCA.exe
3512	svchost_ABBACBABBCBCAACABCCCACCCACCABBBCCAACBBCCABACCCACCBABCCA.exe
4240	svchost_ABBACBABBCBCAACABCCCACCCACCABBBCCAACBBCCABACCCACCBABCCA.exe
4240	svchost_ABBACBABBCBCAACABCCCACCCACCABBBCCAACBBCCABACCCACCBABCCA.exe
4440	svchost_CCACAABCBCBCABCBABBACAAACCCBBCBCBACBABACCBCAACABCBBBCAA.exe
4440	svchost_CCACAABCBCBCABCBABBACAAACCCBBCBCBACBABACCBCAACABCBBBCAA.exe
1944	svchost_ABCBACBBACCABCACCBABBAABCBABCBCCBACAABCABBBBABABBCCCBAA.exe
1944	svchost_ABCBACBBACCABCACCBABBAABCBABCBCCBACAABCABBBBABABBCCCBAA.exe
6352	svchost_ABCBACBBACCABCACCBABBAABCBABCBCCBACAABCABBBBABABBCCCBAA.exe
6352	svchost_ABCBACBBACCABCACCBABBAABCBABCBCCBACAABCABBBBABABBCCCBAA.exe
4372	svchost_CBCABCCCCCACABAAABABCACAAACBCACCACCBBACAABBCCACBBCACABA.exe
1084	svchost_BACBCCBCCCAAABCAACAACAABCBCCCBBCAACCCBCCBACCABBBCACCBAA.exe
1084	svchost_BACBCCBCCCAAABCAACAACAABCBCCCBBCAACCCBCCBACCABBBCACCBAA.exe
4372	svchost_CBCABCCCCCACABAAABABCACAAACBCACCACCBBACAABBCCACBBCACABA.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	4532	2026-07-15_040ccf64e773fdc5ca42132d2b9bd264_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
Token: SeDebugPrivilege	4432	svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe
Token: SeDebugPrivilege	3276	svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe
Token: SeDebugPrivilege	2648	svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe
Token: SeDebugPrivilege	5776	svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe
Token: SeDebugPrivilege	3496	svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe
Token: SeDebugPrivilege	5480	svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe
Token: SeDebugPrivilege	4664	svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe
Token: SeDebugPrivilege	3096	svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe
Token: SeDebugPrivilege	1324	svchost_ABCABCBBBCACCBABACBBCCBACBBCCCCCACBBBACAAABBBBCBCAACCBB.exe
Token: SeDebugPrivilege	3192	svchost_AACBABAACBACBCBCBCAABBABABABCBBBBBAAAAAABBCBABACACCBCBA.exe
Token: SeDebugPrivilege	5160	svchost_AACBABAACBACBCBCBCAABBABABABCBBBBBAAAAAABBCBABACACCBCBA.exe
Token: SeDebugPrivilege	1340	svchost_ABCABCBBBCACCBABACBBCCBACBBCCCCCACBBBACAAABBBBCBCAACCBB.exe
Token: SeDebugPrivilege	3224	svchost_ABCACCABCBBACBCAABCACACBBBAACABCBCCACBACABBBCBBBCCBBCBA.exe
Token: SeDebugPrivilege	5584	svchost_ABCACCABCBBACBCAABCACACBBBAACABCBCCACBACABBBCBBBCCBBCBA.exe
Token: SeDebugPrivilege	6400	svchost_CCCABCBCBACAABCABCCCACABCACBBABABABBBBCCABABCACAAACCBCB.exe
Token: SeDebugPrivilege	6116	svchost_CCCABCBCBACAABCABCCCACABCACBBABABABBBBCCABABCACAAACCBCB.exe
Token: SeDebugPrivilege	5700	svchost_BACCBACAABBABABBBCABABBBBACBCCBBCBACAACCCAABCACAACACABB.exe
Token: SeDebugPrivilege	6176	svchost_BACCBACAABBABABBBCABABBBBACBCCBBCBACAACCCAABCACAACACABB.exe
Token: SeDebugPrivilege	1444	svchost_CCACAABCBCBCABCBABBACAAACCCBBCBCBACBABACCBCAACABCBBBCAA.exe
Token: SeDebugPrivilege	3512	svchost_ABBACBABBCBCAACABCCCACCCACCABBBCCAACBBCCABACCCACCBABCCA.exe
Token: SeDebugPrivilege	4240	svchost_ABBACBABBCBCAACABCCCACCCACCABBBCCAACBBCCABACCCACCBABCCA.exe
Token: SeDebugPrivilege	4440	svchost_CCACAABCBCBCABCBABBACAAACCCBBCBCBACBABACCBCAACABCBBBCAA.exe
Token: SeDebugPrivilege	1944	svchost_ABCBACBBACCABCACCBABBAABCBABCBCCBACAABCABBBBABABBCCCBAA.exe
Token: SeDebugPrivilege	6352	svchost_ABCBACBBACCABCACCBABBAABCBABCBCCBACAABCABBBBABABBCCCBAA.exe
Token: SeDebugPrivilege	1084	svchost_BACBCCBCCCAAABCAACAACAABCBCCCBBCAACCCBCCBACCABBBCACCBAA.exe
Token: SeDebugPrivilege	4372	svchost_CBCABCCCCCACABAAABABCACAAACBCACCACCBBACAABBCCACBBCACABA.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 4196	4532	2026-07-15_040ccf64e773fdc5ca42132d2b9bd264_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe	88
PID 4196 wrote to memory of 6180	4196	cmd.exe	90
PID 4532 wrote to memory of 6736	4532	2026-07-15_040ccf64e773fdc5ca42132d2b9bd264_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe	91
PID 6736 wrote to memory of 6992	6736	cmd.exe	93
PID 4532 wrote to memory of 3364	4532	2026-07-15_040ccf64e773fdc5ca42132d2b9bd264_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe	94
PID 3364 wrote to memory of 7112	3364	cmd.exe	97
PID 4432 wrote to memory of 6360	4432	svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe	101
PID 6360 wrote to memory of 6340	6360	cmd.exe	103
PID 4432 wrote to memory of 6124	4432	svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe	104
PID 6124 wrote to memory of 3196	6124	cmd.exe	106
PID 4432 wrote to memory of 6244	4432	svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe	107
PID 6244 wrote to memory of 6928	6244	cmd.exe	109
PID 3276 wrote to memory of 5596	3276	svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe	113
PID 5596 wrote to memory of 3572	5596	cmd.exe	116
PID 3276 wrote to memory of 2544	3276	svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe	117
PID 2544 wrote to memory of 1560	2544	cmd.exe	119
PID 3276 wrote to memory of 1504	3276	svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe	120
PID 1504 wrote to memory of 7164	1504	cmd.exe	123
PID 2648 wrote to memory of 4592	2648	svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe	125
PID 4592 wrote to memory of 6944	4592	cmd.exe	127
PID 2648 wrote to memory of 7032	2648	svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe	128
PID 7032 wrote to memory of 2768	7032	cmd.exe	130
PID 2648 wrote to memory of 1220	2648	svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe	131
PID 5776 wrote to memory of 2872	5776	svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe	133
PID 1220 wrote to memory of 4236	1220	cmd.exe	137
PID 3496 wrote to memory of 2908	3496	svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe	138
PID 2908 wrote to memory of 6252	2908	cmd.exe	142
PID 2872 wrote to memory of 6808	2872	cmd.exe	143
PID 5776 wrote to memory of 1840	5776	svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe	144
PID 3496 wrote to memory of 3688	3496	svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe	146
PID 1840 wrote to memory of 4936	1840	cmd.exe	149
PID 3688 wrote to memory of 6352	3688	cmd.exe	151
PID 5776 wrote to memory of 3780	5776	svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe	152
PID 3496 wrote to memory of 3772	3496	svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe	154
PID 3780 wrote to memory of 2024	3780	cmd.exe	156
PID 3772 wrote to memory of 3384	3772	cmd.exe	158
PID 5480 wrote to memory of 5904	5480	svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe	159
PID 5904 wrote to memory of 5964	5904	cmd.exe	161
PID 5480 wrote to memory of 4480	5480	svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe	162
PID 4480 wrote to memory of 6904	4480	cmd.exe	164
PID 5480 wrote to memory of 2472	5480	svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe	165
PID 2472 wrote to memory of 6932	2472	cmd.exe	169
PID 4664 wrote to memory of 3228	4664	svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe	173
PID 3096 wrote to memory of 2192	3096	svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe	175
PID 3228 wrote to memory of 6748	3228	cmd.exe	178
PID 2192 wrote to memory of 3240	2192	cmd.exe	179
PID 4664 wrote to memory of 6200	4664	svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe	180
PID 3096 wrote to memory of 2452	3096	svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe	182
PID 6200 wrote to memory of 1140	6200	cmd.exe	184
PID 4664 wrote to memory of 4648	4664	svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe	186
PID 2452 wrote to memory of 1420	2452	cmd.exe	188
PID 4648 wrote to memory of 4172	4648	cmd.exe	190
PID 3096 wrote to memory of 4388	3096	svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe	192
PID 4388 wrote to memory of 6764	4388	cmd.exe	194
PID 1324 wrote to memory of 2360	1324	svchost_ABCABCBBBCACCBABACBBCCBACBBCCCCCACBBBACAAABBBBCBCAACCBB.exe	195
PID 2360 wrote to memory of 2460	2360	cmd.exe	260
PID 1324 wrote to memory of 120	1324	svchost_ABCABCBBBCACCBABACBBCCBACBBCCCCCACBBBACAAABBBBCBCAACCBB.exe	201
PID 120 wrote to memory of 2712	120	cmd.exe	262
PID 1324 wrote to memory of 6480	1324	svchost_ABCABCBBBCACCBABACBBCCBACBBCCCCCACBBBACAAABBBBCBCAACCBB.exe	204
PID 6480 wrote to memory of 4484	6480	cmd.exe	206
PID 3192 wrote to memory of 1008	3192	svchost_AACBABAACBACBCBCBCAABBABABABCBBBBBAAAAAABBCBABACACCBCBA.exe	207
PID 1008 wrote to memory of 4672	1008	cmd.exe	209
PID 3192 wrote to memory of 2380	3192	svchost_AACBABAACBACBCBCBCAABBABABABCBBBBBAAAAAABBCBABACACCBCBA.exe	210
PID 2380 wrote to memory of 7104	2380	cmd.exe	215

C:\Users\Admin\AppData\Local\Temp\2026-07-15_040ccf64e773fdc5ca42132d2b9bd264_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_040ccf64e773fdc5ca42132d2b9bd264_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBBCABCBBAAAABACAACABACBBBBCBBBCBAACAACACBCBBBBAAACBCABCABAACACBBCBABBCBCABBCCBCACBCBBACACABCABCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBBCABCBBAAAABACAACABACBBBBCBBBCBAACAACACBCBBBBAAACBCABCABAACACBBCBABBCBCABBCCBCACBCBBACACABCABCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBAACBBCAACCCBACACAABABBBCCCAACBAAACCAABCBCACBCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe" start= auto displayName= "UserDataSvc_BBBAACBBCAACCCBACACAABABBBCCCAACBAAACCAABCBCACBCAAC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6736
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBAACBBCAACCCBACACAABABBBCCCAACBAAACCAABCBCACBCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe" start= auto displayName= "UserDataSvc_BBBAACBBCAACCCBACACAABABBBCCCAACBAAACCAABCBCACBCAAC"
    3⤵
    - Launches sc.exe
    PID:6992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBAACBBCAACCCBACACAABABBBCCCAACBAAACCAABCBCACBCAAC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBAACBBCAACCCBACACAABABBBCCCAACBAAACCAABCBCACBCAAC"
    3⤵
    - Launches sc.exe
    PID:7112

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABABCBCABBACAAACBBBACCABABCCAAABAACCAABCCBCBBBCBACBCBABCBAABACACACCCBACCBBCCBAAAACABACCCBBBBACAAABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABABCBCABBACAAACBBBACCABABCCAAABAACCAABCCBCBBBCBACBCBABCBAABACACACCCBACCBBCCBAAAACABACCCBBBBACAAABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:6340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBBACCBACBCCBBACAABCBBABACCCCCAAAACABBACCBBCCCCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe" start= auto displayName= "UserDataSvc_CBBBACCBACBCCBBACAABCBBABACCCCCAAAACABBACCBBCCCCCBC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBBACCBACBCCBBACAABCBBABACCCCCAAAACABBACCBBCCCCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe" start= auto displayName= "UserDataSvc_CBBBACCBACBCCBBACAABCBBABACCCCCAAAACABBACCBBCCCCCBC"
    3⤵
    - Launches sc.exe
    PID:3196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBBACCBACBCCBBACAABCBBABACCCCCAAAACABBACCBBCCCCCBC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6244
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBBACCBACBCCBBACAABCBBABACCCCCAAAACABBACCBBCCCCCBC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6928

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBABABACABCBCBBCABACAACAAABBBAAAACABAACCBCACCACCACCCBAAAABABABCACBAABBBACACBBBAAAAAAAABACCCCCBCBACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBABABACABCBCBBCABACAACAAABBBAAAACABAACCBCACCACCACCCBAAAABABABCACBAABBBACACBBBAAAAAAAABACCCCCBCBACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABABAAAABCBBBACABCACABCCACCBCCCAACBABBBCCCACAABAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe" start= auto displayName= "UserDataSvc_CABABAAAABCBBBACABCACABCCACCBCCCAACBABBBCCCACAABAAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABABAAAABCBBBACABCACABCCACCBCCCAACBABBBCCCACAABAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe" start= auto displayName= "UserDataSvc_CABABAAAABCBBBACABCACABCCACCBCCCAACBABBBCCCACAABAAB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABABAAAABCBBBACABCACABCCACCBCCCAACBABBBCCCACAABAAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABABAAAABCBBBACABCACABCCACCBCCCAACBABBBCCCACAABAAB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7164

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCAAABBAAABABACCCBBBCBBAABAABCBBACBCBACAACCCCCCAAABBBBBCCCCBBBABAABBABBCAAACBBBCCAAABAABBCABBCCBCCBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCABCBBACBCAABCACACBBBAACABCBCCACBACABBBCBBBCCBBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCAAABBAAABABACCCBBBCBBAABAABCBBACBCBACAACCCCCCAAABBBBBCCCCBBBABAABBABBCAAACBBBCCAAABAABBCABBCCBCCBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCABCBBACBCAABCACACBBBAACABCBCCACBACABBBCBBBCCBBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAACABACBBCACCCCABBABBACAAACACCCCAACCCACBAAABBAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCABCBBACBCAABCACACBBBAACABCBCCACBACABBBCBBBCCBBCBA.exe" start= auto displayName= "UserDataSvc_AAACABACBBCACCCCABBABBACAAACACCCCAACCCACBAAABBAAABB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAACABACBBCACCCCABBABBACAAACACCCCAACCCACBAAABBAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCABCBBACBCAABCACACBBBAACABCBCCACBACABBBCBBBCCBBCBA.exe" start= auto displayName= "UserDataSvc_AAACABACBBCACCCCABBABBACAAACACCCCAACCCACBAAABBAAABB"
    3⤵
    PID:6352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAACABACBBCACCCCABBABBACAAACACCCCAACCCACBAAABBAAABB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAACABACBBCACCCCABBABBACAAACACCCCAACCCACBAAABBAAABB"
    3⤵
    - Launches sc.exe
    PID:3384

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCCCCCCAACBBCBBCAACBABABABBBCABACBABCCCCAABCABAABA.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACCABCBBACBCAABCACACBBBAACABCBCCACBACABBBCBBBCCBBCBAABBCACCBCCCAACCCCCCCACCBCBBBBBCACBCBAABBBBAABCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCBBBCACCBABACBBCCBACBBCCCCCACBBBACAAABBBBCBCAACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACCABCBBACBCAABCACACBBBAACABCBCCACBACABBBCBBBCCBBCBAABBCACCBCCCAACCCCCCCACCBCBBBBBCACBCBAABBBBAABCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCBBBCACCBABACBBCCBACBBCCCCCACBBBACAAABBBBCBCAACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACACACABCBCACBBCCCCABAABBACCABABAACAAACABBCACABCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCBBBCACCBABACBBCCBACBBCCCCCACBBBACAAABBBBCBCAACCBB.exe" start= auto displayName= "UserDataSvc_ACACACABCBCACBBCCCCABAABBACCABABAACAAACABBCACABCBAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACACACABCBCACBBCCCCABAABBACCABABAACAAACABBCACABCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCBBBCACCBABACBBCCBACBBCCCCCACBBBACAAABBBBCBCAACCBB.exe" start= auto displayName= "UserDataSvc_ACACACABCBCACBBCCCCABAABBACCABABAACAAACABBCACABCBAB"
    3⤵
    PID:4936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACACACABCBCACBBCCCCABAABBACCABABAACAAACABBCACABCBAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACACACABCBCACBBCCCCABAABBACCABABAACAAACABBCACABCBAB"
    3⤵
    PID:2024

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCCBCBABCABCCAAACACBABAACBBCCACCCABBCAACBBACAACCBCABBBABBBBABBBCBAABCBBABCABACCCABBCCBCCCCCCCBCCABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCCBCBABCABCCAAACACBABAACBBCCACCCABBCAACBBACAACCBCABBBABBBBABBBCBAABCBBABCABACCCABBCCBCCCCCCCBCCABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:6944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCCCCBCBCCCBBACCACACBBBBCABBAACBACBBACAABBCCBACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe" start= auto displayName= "UserDataSvc_ABCCCCBCBCCCBBACCACACBBBBCABBAACBACBBACAABBCCBACBAB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:7032
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCCCCBCBCCCBBACCACACBBBBCABBAACBACBBACAABBCCBACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe" start= auto displayName= "UserDataSvc_ABCCCCBCBCCCBBACCACACBBBBCABBAACBACBBACAABBCCBACBAB"
    3⤵
    PID:2768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCCCCBCBCCCBBACCACACBBBBCABBAACBACBBACAABBCCBACBAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCCCCBCBCCCBBACCACACBBBBCABBAACBACBBACAABBCCBACBAB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4236

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBBCBCBCCBCCCACACABCBBBBABABBBACCBCCABCAACBCACACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACCAACBACBCAACBABABABABBCBCABCACBABBBAACABAAAACBCABBCBABBACCCACBCBBCACBBBACBACACCAAAAAAAABCBABABABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABAACBACBCBCBCAABBABABABCBBBBBAAAAAABBCBABACACCBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACCAACBACBCAACBABABABABBCBCABCACBABBBAACABAAAACBCABBCBABBACCCACBCBBCACBBBACBACACCAAAAAAAABCBABABABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABAACBACBCBCBCAABBABABABCBBBBBAAAAAABBCBABACACCBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABABCACBACABBBCBAACBCCBABBAAAAABBBBCBCABCCCABBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABAACBACBCBCBCAABBABABABCBBBBBAAAAAABBCBABACACCBCBA.exe" start= auto displayName= "UserDataSvc_BBABABCACBACABBBCBAACBCCBABBAAAAABBBBCBCABCCCABBABC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBABABCACBACABBBCBAACBCCBABBAAAAABBBBCBCABCCCABBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABAACBACBCBCBCAABBABABABCBBBBBAAAAAABBCBABACACCBCBA.exe" start= auto displayName= "UserDataSvc_BBABABCACBACABBBCBAACBCCBABBAAAAABBBBCBCABCCCABBABC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBABABCACBACABBBCBAACBCCBABBAAAAABBBBCBCABCCCABBABC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBABABCACBACABBBCBAACBCCBABBAAAAABBBBCBCABCCCABBABC"
    3⤵
    PID:6932

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAACAABBCABCABBAABABCBABBCCCAACBCBBCBBBBCBCBBCABCBAAAABCABCCCBCACACCACCBCBBBCCBCAAACBAACAABCCCABBCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCBCCCAAABCAACAACAABCBCCCBBCAACCCBCCBACCABBBCACCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAACAABBCABCABBAABABCBABBCCCAACBCBBCBBBBCBCBBCABCBAAAABCABCCCBCACACCACCBCBBBCCBCAAACBAACAABCCCABBCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCBCCCAAABCAACAACAABCBCCCBBCAACCCBCCBACCABBBCACCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABACBCACACCAAABBCACBCACCACCCBCBABABABBCABABACCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCBCCCAAABCAACAACAABCBCCCBBCAACCCBCCBACCABBBCACCBAA.exe" start= auto displayName= "UserDataSvc_CCABACBCACACCAAABBCACBCACCACCCBCBABABABBCABABACCACA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6200
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABACBCACACCAAABBCACBCACCACCCBCBABABABBCABABACCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCBCCCAAABCAACAACAABCBCCCBBCAACCCBCCBACCABBBCACCBAA.exe" start= auto displayName= "UserDataSvc_CCABACBCACACCAAABBCACBCACCACCCBCBABABABBCABABACCACA"
    3⤵
    - Launches sc.exe
    PID:1140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABACBCACACCAAABBCACBCACCACCCBCBABABABBCABABACCACA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABACBCACACCAAABBCACBCACCACCCBCBABABABBCABABACCACA"
    3⤵
    PID:4172

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABACACCABCAAAABBACBBCAACBAABBBCCCCBABBCAAACACCAABA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBABACBCCCAABBBAABCBABACCABCACBABBBBBBAABBBCAAAAACABCBBAAABACACBBBAACABCBCCCABCCCCBABCCABBBBBCAAAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBCBACAABCABCCCACABCACBBABABABBBBCCABABCACAAACCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBABACBCCCAABBBAABCBABACCABCACBABBBBBBAABBBCAAAAACABCBBAAABACACBBBAACABCBCCCABCCCCBABCCABBBBBCAAAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBCBACAABCABCCCACABCACBBABABABBBBCCABABCACAAACCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCCBBABCABBBCABCABBAAACBACAACAABBCCAABCCCBAABABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBCBACAABCABCCCACABCACBBABABABBBBCCABABCACAAACCBCB.exe" start= auto displayName= "UserDataSvc_BACCCBBABCABBBCABCABBAAACBACAACAABBCCAABCCCBAABABAC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCCBBABCABBBCABCABBAAACBACAACAABBCCAABCCCBAABABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBCBACAABCABCCCACABCACBBABABABBBBCCABABCACAAACCBCB.exe" start= auto displayName= "UserDataSvc_BACCCBBABCABBBCABCABBAAACBACAACAABBCCAABCCCBAABABAC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCCBBABCABBBCABCABBAAACBACAACAABBCCAABCCCBAABABAC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACCCBBABCABBBCABCABBAAACBACAACAABBCCAABCCCBAABABAC"
    3⤵
    - Launches sc.exe
    PID:6764

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCBBBCACCBABACBBCCBACBBCCCCCACBBBACAAABBBBCBCAACCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCBBBCACCBABACBBCCBACBBCCCCCACBBBACAAABBBBCBCAACCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBCCBCBCCCCCBBBCBBCBABABAABBBABACCAAAACCCAAACCCBCBBAABACCABCCBCACAACAAAABBCABACBBBBBABBCCBCBBBCBAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBACAABBABABBBCABABBBBACBCCBBCBACAACCCAABCACAACACABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBCCBCBCCCCCBBBCBBCBABABAABBBABACCAAAACCCAAACCCBCBBAABACCABCCBCACAACAAAABBCABACBBBBBABBCCBCBBBCBAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBACAABBABABBBCABABBBBACBCCBBCBACAACCCAABCACAACACABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:2460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABABCCABCBCCBBBBACABCBCCBAABCCAABCBCBBBBCBAACBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBACAABBABABBBCABABBBBACBCCBBCBACAACCCAABCACAACACABB.exe" start= auto displayName= "UserDataSvc_BCABABCCABCBCCBBBBACABCBCCBAABCCAABCBCBBBBCBAACBBCB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:120
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABABCCABCBCCBBBBACABCBCCBAABCCAABCBCBBBBCBAACBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBACAABBABABBBCABABBBBACBCCBBCBACAACCCAABCACAACACABB.exe" start= auto displayName= "UserDataSvc_BCABABCCABCBCCBBBBACABCBCCBAABCCAABCBCBBBBCBAACBBCB"
    3⤵
    PID:2712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABABCCABCBCCBBBBACABCBCCBAABCCAABCBCBBBBCBAACBBCB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6480
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABABCCABCBCCBBBBACABCBCCBAABCCAABCBCBBBBCBAACBBCB"
    3⤵
    PID:4484

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCBBBCACCBABACBBCCBACBBCCCCCACBBBACAAABBBBCBCAACCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCBBBCACCBABACBBCCBACBBCCCCCACBBBACAAABBBBCBCAACCBB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBABABBCCCBABACBBCBCACBCACACACCBACBBAABABBCBAABCAABBBCCCCBAAAACBABACBBCBACBCCBACCBAAACAACCAAAAABBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACABBBABCABBCBACBAACCAAABACCCAACACCACCCBBCACCCCABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBABABBCCCBABACBBCBCACBCACACACCBACBBAABABBCBAABCAABBBCCCCBAAAACBABACBBCBACBCCBACCBAAACAACCAAAAABBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACABBBABCABBCBACBAACCAAABACCCAACACCACCCBBCACCCCABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBBABCBCBCBABBABABABBBBACACCCBCACAAACAABABBCCABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACABBBABCABBCBACBAACCAAABACCCAACACCACCCBBCACCCCABBAA.exe" start= auto displayName= "UserDataSvc_CBCBBABCBCBCBABBABABABBBBACACCCBCACAAACAABABBCCABCC"
  2⤵
  PID:1304
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBBABCBCBCBABBABABABBBBACACCCBCACAAACAABABBCCABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACABBBABCABBCBACBAACCAAABACCCAACACCACCCBBCACCCCABBAA.exe" start= auto displayName= "UserDataSvc_CBCBBABCBCBCBABBABABABBBBACACCCBCACAAACAABABBCCABCC"
    3⤵
    - Launches sc.exe
    PID:4752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBBABCBCBCBABBABABABBBBACACCCBCACAAACAABABBCCABCC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4876
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBBABCBCBCBABBABABABBBBACACCCBCACAAACAABABBCCABCC"
    3⤵
    - Launches sc.exe
    PID:6016

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCABCBBACBCAABCACACBBBAACABCBCCACBACABBBCBBBCCBBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCABCBBACBCAABCACACBBBAACABCBCCACBACABBBCBBBCCBBCBA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBABCCCACBABACCBBCAACAAAACBBACBBAABBCCCBACCCBAABCBCABACBCAAACCACCCAABBBBBBACBBCCABBAACCAAACCACBBBBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAABACBBCCAABAAAACACCABAACBAAABCABCAAABACAABABABCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBABCCCACBABACCBBCAACAAAACBBACBBAABBCCCBACCCBAABCBCABACBCAAACCACCCAABBBBBBACBBCCABBAACCAAACCACBBBBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAABACBBCCAABAAAACACCABAACBAAABCABCAAABACAABABABCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACBBBBABCCCABCCCACBABCBBACCCCBCCAAACCABABBBCBBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAABACBBCCAABAAAACACCABAACBAAABCABCAAABACAABABABCBBB.exe" start= auto displayName= "UserDataSvc_BBACBBBBABCCCABCCCACBABCBBACCCCBCCAAACCABABBBCBBABC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4824
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBACBBBBABCCCABCCCACBABCBBACCCCBCCAAACCABABBBCBBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAABACBBCCAABAAAACACCABAACBAAABCABCAAABACAABABABCBBB.exe" start= auto displayName= "UserDataSvc_BBACBBBBABCCCABCCCACBABCBBACCCCBCCAAACCABABBBCBBABC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACBBBBABCCCABCCCACBABCBBACCCCBCCAAACCABABBBCBBABC"
  2⤵
  PID:6812
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBACBBBBABCCCABCCCACBABCBBACCCCBCCAAACCABABBBCBBABC"
    3⤵
    - Launches sc.exe
    PID:420

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCABCBBACBCAABCACACBBBAACABCBCCACBACABBBCBBBCCBBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCABCBBACBCAABCACACBBBAACABCBCCACBACABBBCBBBCCBBCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCCCBCBCACCCACCABBBABABCAAACBCBCAABCBAABCABCCBBBCBCCCABAABCAACBACBABCAABCABCBBBBABAACACBAABAAAABABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBABBCBCAACABCCCACCCACCABBBCCAACBBCCABACCCACCBABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCCCBCBCACCCACCABBBABABCAAACBCBCAABCBAABCABCCBBBCBCCCABAABCAACBACBABCAABCABCBBBBABAACACBAABAAAABABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBABBCBCAACABCCCACCCACCABBBCCAACBBCCABACCCACCBABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABBBCBCCCBACCACCBBCBABCAABBCACBCACCACBABACABBAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBABBCBCAACABCCCACCCACCABBBCCAACBBCCABACCCACCBABCCA.exe" start= auto displayName= "UserDataSvc_BCABBBCBCCCBACCACCBBCBABCAABBCACBCACCACBABACABBAABB"
  2⤵
  PID:1832
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABBBCBCCCBACCACCBBCBABCAABBCACBCACCACBABACABBAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBABBCBCAACABCCCACCCACCABBBCCAACBBCCABACCCACCBABCCA.exe" start= auto displayName= "UserDataSvc_BCABBBCBCCCBACCACCBBCBABCAABBCACBCACCACBABACABBAABB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABBBCBCCCBACCACCBBCBABCAABBCACBCACCACBABACABBAABB"
  2⤵
  PID:5140
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABBBCBCCCBACCACCBBCBABCAABBCACBCACCACBABACABBAABB"
    3⤵
    PID:6120

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABAACBACBCBCBCAABBABABABCBBBBBAAAAAABBCBABACACCBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABAACBACBCBCBCAABBABABABCBBBBBAAAAAABBCBABACACCBCBA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABAAABBABCCAABACCBBABABACBBBCCABCCCACBBCCBBBBCBBAAACCCABCCCAACBBCACBBACBCCCBBCBBAAABCCBACCCABBCBBCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACBBACCABCACCBABBAABCBABCBCCBACAABCABBBBABABBCCCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABAAABBABCCAABACCBBABABACBBBCCABCCCACBBCCBBBBCBBAAACCCABCCCAACBBCACBBACBCCCBBCBBAAABCCBACCCABBCBBCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACBBACCABCACCBABBAABCBABCBCCBACAABCABBBBABABBCCCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBAAABBBAACBAABCCACCAACBCABCAABCBBABABACAACAAABCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACBBACCABCACCBABBAABCBABCBCCBACAABCABBBBABABBCCCBAA.exe" start= auto displayName= "UserDataSvc_ABBAAABBBAACBAABCCACCAACBCABCAABCBBABABACAACAAABCAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBAAABBBAACBAABCCACCAACBCABCAABCBBABABACAACAAABCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACBBACCABCACCBABBAABCBABCBCCBACAABCABBBBABABBCCCBAA.exe" start= auto displayName= "UserDataSvc_ABBAAABBBAACBAABCCACCAACBCABCAABCBBABABACAACAAABCAB"
    3⤵
    - Launches sc.exe
    PID:7104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBAAABBBAACBAABCCACCAACBCABCAABCBBABABACAACAAABCAB"
  2⤵
  PID:4612
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBAAABBBAACBAABCCACCAACBCABCAABCBBABABACAACAAABCAB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4120

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABAACBACBCBCBCAABBABABABCBBBBBAAAAAABBCBABACACCBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABAACBACBCBCBCAABBABABABCBBBBBAAAAAABBCBABACACCBCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCABBCBBCCAAAACCBCBCBCCACBBACBCABABAABABCCABCCCCCCCAACAACCACAACBBABBBBBACCAACCACCBBACBCCBCCBABBBBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBBBABBACCBBCACCBACCABCCBABACBACCCACCCBCACCACCBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3124
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCABBCBBCCAAAACCBCBCBCCACBBACBCABABAABABCCABCCCCCCCAACAACCACAACBBABBBBBACCAACCACCBBACBCCBCCBABBBBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBBBABBACCBBCACCBACCABCCBABACBACCCACCCBCACCACCBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:4520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBBACBBCCBBBBCBCCABBBCBBBABCCCABBCCACCBACBBCBBAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBBBABBACCBBCACCBACCABCCBABACBACCCACCCBCACCACCBCBA.exe" start= auto displayName= "UserDataSvc_CBBBACBBCCBBBBCBCCABBBCBBBABCCCABBCCACCBACBBCBBAACC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5432
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBBACBBCCBBBBCBCCABBBCBBBABCCCABBCCACCBACBBCBBAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBBBABBACCBBCACCBACCABCCBABACBACCCACCCBCACCACCBCBA.exe" start= auto displayName= "UserDataSvc_CBBBACBBCCBBBBCBCCABBBCBBBABCCCABBCCACCBACBBCBBAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBBACBBCCBBBBCBCCABBBCBBBABCCCABBCCACCBACBBCBBAACC"
  2⤵
  PID:928
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBBACBBCCBBBBCBCCABBBCBBBABCCCABBCCACCBACBBCBBAACC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2740

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCBCCCAAABCAACAACAABCBCCCBBCAACCCBCCBACCABBBCACCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCBCCCAAABCAACAACAABCBCCCBBCAACCCBCCBACCABBBCACCBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACACBAABCAACCAABBCBCCCBACCBCBACCBCCBCBCCCABABBCACBCAABBAABBACACBBAACCBBCABCBACBCABCBACCCCBBACACAACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABBBBCACBBBCBBCAAAAABCCCCCABABAAABCBCCBCBBACCACAABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACACBAABCAACCAABBCBCCCBACCBCBACCBCCBCBCCCABABBCACBCAABBAABBACACBBAACCBBCABCBACBCABCBACCCCBBACACAACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABBBBCACBBBCBBCAAAAABCCCCCABABAAABCBCCBCBBACCACAABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCBCBBCABCCCCAABCCACCBBCCCBBCAAACACCCBABACABBBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABBBBCACBBBCBBCAAAAABCCCCCABABAAABCBCCBCBBACCACAABBA.exe" start= auto displayName= "UserDataSvc_ACCCBCBBCABCCCCAABCCACCBBCCCBBCAAACACCCBABACABBBCBA"
  2⤵
  PID:7260
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCCBCBBCABCCCCAABCCACCBBCCCBBCAAACACCCBABACABBBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABBBBCACBBBCBBCAAAAABCCCCCABABAAABCBCCBCBBACCACAABBA.exe" start= auto displayName= "UserDataSvc_ACCCBCBBCABCCCCAABCCACCBBCCCBBCAAACACCCBABACABBBCBA"
    3⤵
    - Launches sc.exe
    PID:7364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCBCBBCABCCCCAABCCACCBBCCCBBCAAACACCCBABACABBBCBA"
  2⤵
  PID:7424
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCCBCBBCABCCCCAABCCACCBBCCCBBCAAACACCCBABACABBBCBA"
    3⤵
    PID:7640

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCBCCCAAABCAACAACAABCBCCCBBCAACCCBCCBACCABBBCACCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCCBCCCAAABCAACAACAABCBCCCBBCAACCCBCCBACCABBBCACCBAA.exe
1⤵
- Executes dropped EXE
PID:4320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAAABABACABBCBACAACAACBAAACACCCCBBBCBAABCBACACABAAABABBBAACCABABCAABCCCBCCBBABCBCAABABACACAAAAACAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBBACACCCCBCABCABAAACABCAAABACAAACBBABBBABABBCBCAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAAABABACABBCBACAACAACBAAACACCCCBBBCBAABCBACACABAAABABBBAACCABABCAABCCCBCCBBABCBCAABABACACAAAAACAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBBACACCCCBCABCABAAACABCAAABACAAACBBABBBABABBCBCAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:7696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCBCBAAABABBCAAAACCCACBABCBABBCBCCAACAACABABCAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBBACACCCCBCABCABAAACABCAAABACAAACBBABBBABABBCBCAABA.exe" start= auto displayName= "UserDataSvc_CACCBCBAAABABBCAAAACCCACBABCBABBCBCCAACAACABABCAAAA"
  2⤵
  PID:7912
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACCBCBAAABABBCAAAACCCACBABCBABBCBCCAACAACABABCAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBBACACCCCBCABCABAAACABCAAABACAAACBBABBBABABBCBCAABA.exe" start= auto displayName= "UserDataSvc_CACCBCBAAABABBCAAAACCCACBABCBABBCBCCAACAACABABCAAAA"
    3⤵
    - Launches sc.exe
    PID:8016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCBCBAAABABBCAAAACCCACBABCBABBCBCCAACAACABABCAAAA"
  2⤵
  PID:8128
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACCBCBAAABABBCAAAACCCACBABCBABBCBCCAACAACABABCAAAA"
    3⤵
    PID:7204

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBCBACAABCABCCCACABCACBBABABABBBBCCABABCACAAACCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBCBACAABCABCCCACABCACBBABABABBBBCCABABCACAAACCBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACABBBBACCAAABBBBCCCBACACABCCAAAABCCCCBBCABAABABAACBBBBBCCCCCCCCBAACACBAAACCCBBCABCAABCAABBBCAAAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBACCCBBAABBCCCCCCAABBCBAAAAACBBBAABCBAACABABACBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:236
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACABBBBACCAAABBBBCCCBACACABCCAAAABCCCCBBCABAABABAACBBBBBCCCCCCCCBAACACBAAACCCBBCABCAABCAABBBCAAAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBACCCBBAABBCCCCCCAABBCBAAAAACBBBAABCBAACABABACBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBAABCCCACBCAACCACACBBACAAAAAABABCABACBACCBAABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBACCCBBAABBCCCCCCAABBCBAAAAACBBBAABCBAACABABACBCB.exe" start= auto displayName= "UserDataSvc_CACBAABCCCACBCAACCACACBBACAAAAAABABCABACBACCBAABBBC"
  2⤵
  PID:6928
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBAABCCCACBCAACCACACBBACAAAAAABABCABACBACCBAABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBACCCBBAABBCCCCCCAABBCBAAAAACBBBAABCBAACABABACBCB.exe" start= auto displayName= "UserDataSvc_CACBAABCCCACBCAACCACACBBACAAAAAABABCABACBACCBAABBBC"
    3⤵
    PID:5412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBAABCCCACBCAACCACACBBACAAAAAABABCABACBACCBAABBBC"
  2⤵
  PID:3492
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACBAABCCCACBCAACCACACBBACAAAAAABABCABACBACCBAABBBC"
    3⤵
    PID:2928

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBCBACAABCABCCCACABCACBBABABABBBBCCABABCACAAACCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBCBACAABCABCCCACABCACBBABABABBBBCCABABCACAAACCBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCBABBBBCCBBCBBBBBCBABABCBACCAAABBCCABAABBACAACCBACBBBBCABCBBAAABCAABBBBCBCCBBBBAACCABACBBCCABBCBBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAABCBCBCABCBABBACAAACCCBBCBCBACBABACCBCAACABCBBBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2460
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCBABBBBCCBBCBBBBBCBABABCBACCAAABBCCABAABBACAACCBACBBBBCABCBBAAABCAABBBBCBCCBBBBAACCABACBBCCABBCBBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAABCBCBCABCBABBACAAACCCBBCBCBACBABACCBCAACABCBBBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABCBBCBBCCBCABCBCCABABBAACBACACBAACABBCBCBAACABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAABCBCBCABCBABBACAAACCCBBCBCBACBABACCBCAACABCBBBCAA.exe" start= auto displayName= "UserDataSvc_BAABCBBCBBCCBCABCBCCABABBAACBACACBAACABBCBCBAACABCB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2296
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABCBBCBBCCBCABCBCCABABBAACBACACBAACABBCBCBAACABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAABCBCBCABCBABBACAAACCCBBCBCBACBABACCBCAACABCBBBCAA.exe" start= auto displayName= "UserDataSvc_BAABCBBCBBCCBCABCBCCABABBAACBACACBAACABBCBCBAACABCB"
    3⤵
    PID:4276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABCBBCBBCCBCABCBCCABABBAACBACACBAACABBCBCBAACABCB"
  2⤵
  PID:5036
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABCBBCBBCCBCABCBCCABABBAACBACACBAACABBCBCBAACABCB"
    3⤵
    PID:1160

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBACAABBABABBBCABABBBBACBCCBBCBACAACCCAABCACAACACABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBACAABBABABBBCABABBBBACBCCBBCBACAACCCAABCACAACACABB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBACBCAABACACAABCBCCACCCBCBBCBCCCBACBACABAACCACACACAABABACCCBBABBBCCCACABCCCCBCBACBCACBBBBACAABACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCCCCACABAAABABCACAAACBCACCACCBBACAABBCCACBBCACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBACBCAABACACAABCBCCACCCBCBBCBCCCBACBACABAACCACACACAABABACCCBBABBBCCCACABCCCCBCBACBCACBBBBACAABACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCCCCACABAAABABCACAAACBCACCACCBBACAABBCCACBBCACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAACCCBABBABCCCBAACBCCAAACCCCBAABBBCCBAACACABBCBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCCCCACABAAABABCACAAACBCACCACCBBACAABBCCACBBCACABA.exe" start= auto displayName= "UserDataSvc_AAACCCBABBABCCCBAACBCCAAACCCCBAABBBCCBAACACABBCBABC"
  2⤵
  PID:688
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1216
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAACCCBABBABCCCBAACBCCAAACCCCBAABBBCCBAACACABBCBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCCCCACABAAABABCACAAACBCACCACCBBACAABBCCACBBCACABA.exe" start= auto displayName= "UserDataSvc_AAACCCBABBABCCCBAACBCCAAACCCCBAABBBCCBAACACABBCBABC"
    3⤵
    - Launches sc.exe
    PID:2944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAACCCBABBABCCCBAACBCCAAACCCCBAABBBCCBAACACABBCBABC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7060
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAACCCBABBABCCCBAACBCCAAACCCCBAABBBCCBAACACABBCBABC"
    3⤵
    - Launches sc.exe
    PID:240

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBACAABBABABBBCABABBBBACBCCBBCBACAACCCAABCACAACACABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBACAABBABABBBCABABBBBACBCCBBCBACAACCCAABCACAACACABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACACACBCBAACBACBAAACCCCCABABAABACAAACCBAACCBACCCBCCCBABAAABABABBBBBCBCCBBCCCBBACBCACABACBCACCBAAACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBACBBCCBABCAABAABAAAAACCABBABACBBBBCBBAABCAACBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACACACBCBAACBACBAAACCCCCABABAABACAAACCBAACCBACCCBCCCBABAAABABABBBBBCBCCBBCCCBBACBCACABACBCACCBAAACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBACBBCCBABCAABAABAAAAACCABBABACBBBBCBBAABCAACBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:5800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCCCABBCBBCABAAABAABACABACCCBAAACBBAACAABABCCCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBACBBCCBABCAABAABAAAAACCABBABACBBBBCBBAABCAACBACBC.exe" start= auto displayName= "UserDataSvc_BCBCCCABBCBBCABAAABAABACABACCCBAAACBBAACAABABCCCBAC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:612
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCCCABBCBBCABAAABAABACABACCCBAAACBBAACAABABCCCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBACBBCCBABCAABAABAAAAACCABBABACBBBBCBBAABCAACBACBC.exe" start= auto displayName= "UserDataSvc_BCBCCCABBCBBCABAAABAABACABACCCBAAACBBAACAABABCCCBAC"
    3⤵
    - Launches sc.exe
    PID:6624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCCCABBCBBCABAAABAABACABACCCBAAACBBAACAABABCCCBAC"
  2⤵
  PID:6680
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCCCABBCBBCABAAABAABACABACCCBAAACBBAACAABABCCCBAC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6204

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACBBACCABCACCBABBAABCBABCBCCBACAABCABBBBABABBCCCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACBBACCABCACCBABBAABCBABCBCCBACAABCABBBBABABBCCCBAA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABACBAABCCACBCCABAAACABACBAABBABBBACABBCBCBBABBBABABCAABACBCACCBABCBBBCCABACAAACBCBCBCCABBCCBCACBBACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABAACABBABACBCCCBABBACBBCCCBBAABCBBBAABBABBBACBACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABACBAABCCACBCCABAAACABACBAABBABBBACABBCBCBBABBBABABCAABACBCACCBABCBBBCCABACAAACBCBCBCCABBCCBCACBBACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABAACABBABACBCCCBABBACBBCCCBBAABCBBBAABBABBBACBACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACBCCCABAACBAABCAAACBBABCCABAACBBCCCACACBBCCCAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABAACABBABACBCCCBABBACBBCCCBBAABCBBBAABBABBBACBACBCA.exe" start= auto displayName= "UserDataSvc_CAACBCCCABAACBAABCAAACBBABCCABAACBBCCCACACBBCCCAABB"
  2⤵
  PID:2276
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAACBCCCABAACBAABCAAACBBABCCABAACBBCCCACACBBCCCAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABAACABBABACBCCCBABBACBBCCCBBAABCBBBAABBABBBACBACBCA.exe" start= auto displayName= "UserDataSvc_CAACBCCCABAACBAABCAAACBBABCCABAACBBCCCACACBBCCCAABB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAACBCCCABAACBAABCAAACBBABCCABAACBBCCCACACBBCCCAABB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5456
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAACBCCCABAACBAABCAAACBBABCCABAACBBCCCACACBBCCCAABB"
    3⤵
    PID:6664

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACBBACCABCACCBABBAABCBABCBCCBACAABCABBBBABABBCCCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACBBACCABCACCBABBAABCBABCBCCBACAABCABBBBABABBCCCBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABACAABCCBAABBBCAAAABACAABCACACCCAAACBBCABBBCBCAAACABCABAAAABBCCBBBAABBAAAACBBCBBBAAAAAABBCCCACCBCBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCBAAAACBABBCAAACABCCCAABBACCBAAABCACCBABCBBABBBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1380
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABACAABCCBAABBBCAAAABACAABCACACCCAAACBBCABBBCBCAAACABCABAAAABBCCBBBAABBAAAACBBCBBBAAAAAABBCCCACCBCBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCBAAAACBABBCAAACABCCCAABBACCBAAABCACCBABCBBABBBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACCCBCBCBAABBCCABABABBABCBCCCCBBABACAABCAAABBABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCBAAAACBABBCAAACABCCCAABBACCBAAABCACCBABCBBABBBBCA.exe" start= auto displayName= "UserDataSvc_BBACCCBCBCBAABBCCABABABBABCBCCCCBBABACAABCAAABBABAB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:124
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBACCCBCBCBAABBCCABABABBABCBCCCCBBABACAABCAAABBABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCBAAAACBABBCAAACABCCCAABBACCBAAABCACCBABCBBABBBBCA.exe" start= auto displayName= "UserDataSvc_BBACCCBCBCBAABBCCABABABBABCBCCCCBBABACAABCAAABBABAB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACCCBCBCBAABBCCABABABBABCBCCCCBBABACAABCAAABBABAB"
  2⤵
  PID:4832
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBACCCBCBCBAABBCCABABABBABCBCCCCBBABACAABCAAABBABAB"
    3⤵
    PID:944

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACABBBABCABBCBACBAACCAAABACCCAACACCACCCBBCACCCCABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACABBBABCABBCBACBAACCAAABACCCAACACCACCCBBCACCCCABBAA.exe
1⤵
- Executes dropped EXE
PID:4140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBCCCABBCACCBCABCCBBBABBCCABACCCBCAACABCACCACCCCCCBACACABCCAACBAAACBBABBCABCABBAAAACCCCACCAAACCCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBCCCABBCACCBCABCCBBBABBCCABACCCBCAACABCACCACCCCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBCCCABBCACCBCABCCBBBABBCCABACCCBCAACABCACCACCCCCCBACACABCCAACBAAACBBABBCABCABBAAAACCCCACCAAACCCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBCCCABBCACCBCABCCBBBABBCCABACCCBCAACABCACCACCCCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCBCCCBBCABACBACAABBACAACCBBACACBABAACABCAAACABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBCCCABBCACCBCABCCBBBABBCCABACCCBCAACABCACCACCCCCCBA.exe" start= auto displayName= "UserDataSvc_BBCCBCCCBBCABACBACAABBACAACCBBACACBABAACABCAAACABBC"
  2⤵
  PID:6528
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCBCCCBBCABACBACAABBACAACCBBACACBABAACABCAAACABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBCCCABBCACCBCABCCBBBABBCCABACCCBCAACABCACCACCCCCCBA.exe" start= auto displayName= "UserDataSvc_BBCCBCCCBBCABACBACAABBACAACCBBACACBABAACABCAAACABBC"
    3⤵
    PID:7620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCBCCCBBCABACBACAABBACAACCBBACACBABAACABCAAACABBC"
  2⤵
  PID:8044
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCBCCCBBCABACBACAABBACAACCBBACACBABAACABCAAACABBC"
    3⤵
    - Launches sc.exe
    PID:7992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBBBABBACCBBCACCBACCABCCBABACBACCCACCCBCACCACCBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBBBABBACCBBCACCBACCABCCBABACBACCCACCCBCACCACCBCBA.exe
1⤵
- Executes dropped EXE
PID:4896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBCABBCBABABCACCABBACACCCBABAAAACACCABCAABBCBBCAAABACAAAABACCAAABACBBCAACCABCCBACCACABAAAABBCBCCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCACBBAABACACABABBABABBCBACCCBBCBCBBBCBCACACAAAAABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBCABBCBABABCACCABBACACCCBABAAAACACCABCAABBCBBCAAABACAAAABACCAAABACBBCAACCABCCBACCACABAAAABBCBCCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCACBBAABACACABABBABABBCBACCCBBCBCBBBCBCACACAAAAABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:8292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABBCBAACCCACBACCACCCBBCCBCBCCBCAABCBCBCCACAACCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCACBBAABACACABABBABABBCBACCCBBCBCBBBCBCACACAAAAABCAC.exe" start= auto displayName= "UserDataSvc_BAABBCBAACCCACBACCACCCBBCCBCBCCBCAABCBCBCCACAACCCBC"
  2⤵
  PID:8376
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABBCBAACCCACBACCACCCBBCCBCBCCBCAABCBCBCCACAACCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCACBBAABACACABABBABABBCBACCCBBCBCBBBCBCACACAAAAABCAC.exe" start= auto displayName= "UserDataSvc_BAABBCBAACCCACBACCACCCBBCCBCBCCBCAABCBCBCCACAACCCBC"
    3⤵
    PID:8544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABBCBAACCCACBACCACCCBBCCBCBCCBCAABCBCBCCACAACCCBC"
  2⤵
  PID:8672
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABBCBAACCCACBACCACCCBBCCBCBCCBCAABCBCBCCACAACCCBC"
    3⤵
    PID:8796

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBBBABBACCBBCACCBACCABCCBABACBACCCACCCBCACCACCBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCBBBBABBACCBBCACCBACCABCCBABACBACCCACCCBCACCACCBCBA.exe
1⤵
- Executes dropped EXE
PID:1492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCAAACCCBCACCAACACABBCAAACBAAABAABCBCBBABBCCCBCBACABABCAABBACBBCCABBCAAAABABCAACBBCABCBBBABBBACBACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAAACCCBCACCAACACABBCAAACBAAABAABCBCBBABBCCCBCBACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCAAACCCBCACCAACACABBCAAACBAAABAABCBCBBABBCCCBCBACABABCAABBACBBCCABBCAAAABABCAACBBCABCBBBABBBACBACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAAACCCBCACCAACACABBCAAACBAAABAABCBCBBABBCCCBCBACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:2300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABACCABACBBCAACBBCCACBBABBAACAACABBAABBBACCBAACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAAACCCBCACCAACACABBCAAACBAAABAABCBCBBABBCCCBCBACABA.exe" start= auto displayName= "UserDataSvc_CCABACCABACBBCAACBBCCACBBABBAACAACABBAABBBACCBAACAC"
  2⤵
  PID:8240
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABACCABACBBCAACBBCCACBBABBAACAACABBAABBBACCBAACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAAACCCBCACCAACACABBCAAACBAAABAABCBCBBABBCCCBCBACABA.exe" start= auto displayName= "UserDataSvc_CCABACCABACBBCAACBBCCACBBABBAACAACABBAABBBACCBAACAC"
    3⤵
    PID:8348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABACCABACBBCAACBBCCACBBABBAACAACABBAABBBACCBAACAC"
  2⤵
  PID:8392
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABACCABACBBCAACBBCCACBBABBAACAACABBAABBBACCBAACAC"
    3⤵
    - Launches sc.exe
    PID:8568

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAABACBBCCAABAAAACACCABAACBAAABCABCAAABACAABABABCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAABACBBCCAABAAAACACCABAACBAAABCABCAAABACAABABABCBBB.exe
1⤵
- Executes dropped EXE
PID:1616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCAAABBBCACCBAACCBCABCABBACBBAABCAACACACCABCAABCBAAACCACBCABABCAAACBCBBAABACABABBACACBCABACBACCABBBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCCBBBCCBABCCAABABCBCBCCBAABAABAACACAABCCACCAABACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCAAABBBCACCBAACCBCABCABBACBBAABCAACACACCABCAABCBAAACCACBCABABCAAACBCBBAABACABABBACACBCABACBACCABBBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCCBBBCCBABCCAABABCBCBCCBAABAABAACACAABCCACCAABACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:3308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABABCACCBBCACBAACBCBACAABBBBAACCBBBAACBABAACAACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCCBBBCCBABCCAABABCBCBCCBAABAABAACACAABCCACCAABACBC.exe" start= auto displayName= "UserDataSvc_AAABABCACCBBCACBAACBCBACAABBBBAACCBBBAACBABAACAACAC"
  2⤵
  PID:2740
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABABCACCBBCACBAACBCBACAABBBBAACCBBBAACBABAACAACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCCBBBCCBABCCAABABCBCBCCBAABAABAACACAABCCACCAABACBC.exe" start= auto displayName= "UserDataSvc_AAABABCACCBBCACBAACBCBACAABBBBAACCBBBAACBABAACAACAC"
    3⤵
    PID:10724

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAABACBBCCAABAAAACACCABAACBAAABCABCAAABACAABABABCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAABACBBCCAABAAAACACCABAACBAAABCABCAAABACAABABABCBBB.exe
1⤵
- Executes dropped EXE
PID:1372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBABBBAACAABCAABCCCCAACBAAABCCCBABCAAABCCBBAACBCBBBCCCBBACCCBCBBBCCCCBCBBAACCCAABABBBABCACACCACCBAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCCBBBCCBABCCAABABCBCBCCBAABAABAACACAABCCACCAABACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBABBBAACAABCAABCCCCAACBAAABCCCBABCAAABCCBBAACBCBBBCCCBBACCCBCBBBCCCCBCBBAACCCAABABBBABCACACCACCBAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCCBBBCCBABCCAABABCBCBCCBAABAABAACACAABCCACCAABACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACAACACCACCCCBBAACBBCCBBCCACCACACCBABCABAAACACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCCBBBCCBABCCAABABCBCBCCBAABAABAACACAABCCACCAABACBC.exe" start= auto displayName= "UserDataSvc_CBACAACACCACCCCBBAACBBCCBBCCACCACACCBABCABAAACACBCB"
  2⤵
  PID:10288
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACAACACCACCCCBBAACBBCCBBCCACCACACCBABCABAAACACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCCBBBCCBABCCAABABCBCBCCBAABAABAACACAABCCACCAABACBC.exe" start= auto displayName= "UserDataSvc_CBACAACACCACCCCBBAACBBCCBBCCACCACACCBABCABAAACACBCB"
    3⤵
    - Launches sc.exe
    PID:10736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACAACACCACCCCBBAACBBCCBBCCACCACACCBABCABAAACACBCB"
  2⤵
  PID:11116
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACAACACCACCCCBBAACBBCCBBCCACCACACCBABCABAAACACBCB"
    3⤵
    - Launches sc.exe
    PID:11436

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAABCBCBCABCBABBACAAACCCBBCBCBACBABACCBCAACABCBBBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAABCBCBCABCBABBACAAACCCBBCBCBACBABACCBCAACABCBBBCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBAACBCCAAAACBBACBACCAAAABAABAACCBAABCACCABCBACAACCCBCAABAABBCBCCACABBCCBCBABCACAAABBABBAAAAAABCBBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAACCAAAAAAAABBCACCBBACCACBBAAACBBCBBCABCCAAACBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBAACBCCAAAACBBACBACCAAAABAABAACCBAABCACCABCBACAACCCBCAABAABBCBCCACABBCCBCBABCACAAABBABBAAAAAABCBBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAACCAAAAAAAABBCACCBBACCACBBAAACBBCBBCABCCAAACBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBBCBACBBAABBACACABBBBAACAAACACCABBBAAAAAABAAABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAACCAAAAAAAABBCACCBBACCACBBAAACBBCBBCABCCAAACBAABB.exe" start= auto displayName= "UserDataSvc_CABBBCBACBBAABBACACABBBBAACAAACACCABBBAAAAAABAAABBC"
  2⤵
  PID:2076
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABBBCBACBBAABBACACABBBBAACAAACACCABBBAAAAAABAAABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAACCAAAAAAAABBCACCBBACCACBBAAACBBCBBCABCCAAACBAABB.exe" start= auto displayName= "UserDataSvc_CABBBCBACBBAABBACACABBBBAACAAACACCABBBAAAAAABAAABBC"
    3⤵
    PID:5304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBBCBACBBAABBACACABBBBAACAAACACCABBBAAAAAABAAABBC"
  2⤵
  PID:4256
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABBBCBACBBAABBACACABBBBAACAAACACCABBBAAAAAABAAABBC"
    3⤵
    - Launches sc.exe
    PID:4844

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBABBCBCAACABCCCACCCACCABBBCCAACBBCCABACCCACCBABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBABBCBCAACABCCCACCCACCABBBCCAACBBCCABACCCACCBABCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACACCABCBBAACCCAAAAAABACBCABCCCCCBBACABBAABBBACABCCBBCAAAACBBACACCCBCAAACACACCCBBCACACCBACCAABCBBCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBABBAABCCABCACCCAACACAABABABACCCBCCACBBCBAAACCBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACACCABCBBAACCCAAAAAABACBCABCCCCCBBACABBAABBBACABCCBBCAAAACBBACACCCBCAAACACACCCBBCACACCBACCAABCBBCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBABBAABCCABCACCCAACACAABABABACCCBCCACBBCBAAACCBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABABACBBBBCAABABBCACBAACAAAACACCBBACCBBCABCAACBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBABBAABCCABCACCCAACACAABABABACCCBCCACBBCBAAACCBBBA.exe" start= auto displayName= "UserDataSvc_AABABACBBBBCAABABBCACBAACAAAACACCBBACCBBCABCAACBBCB"
  2⤵
  PID:996
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABABACBBBBCAABABBCACBAACAAAACACCBBACCBBCABCAACBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBABBAABCCABCACCCAACACAABABABACCCBCCACBBCBAAACCBBBA.exe" start= auto displayName= "UserDataSvc_AABABACBBBBCAABABBCACBAACAAAACACCBBACCBBCABCAACBBCB"
    3⤵
    PID:2372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABABACBBBBCAABABBCACBAACAAAACACCBBACCBBCABCAACBBCB"
  2⤵
  PID:4904
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABABACBBBBCAABABBCACBAACAAAACACCBBACCBBCABCAACBBCB"
    3⤵
    PID:5116

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBABBCBCAACABCCCACCCACCABBBCCAACBBCCABACCCACCBABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBABBCBCAACABCCCACCCACCABBBCCAACBBCCABACCCACCBABCCA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBBCBACBAABABBBACBBAAACBBCACCCBABABBBACBCCBABCCABABCCCBCBAAACBCCAAAACCBABACAABACAAACAACBABCCBBAACABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCBBABCABACBCBAACCBABBBCBCABCBCBBCBCBCCACAACAAACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:244
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBBCBACBAABABBBACBBAAACBBCACCCBABABBBACBCCBABCCABABCCCBCBAAACBCCAAAACCBABACAABACAAACAACBABCCBBAACABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCBBABCABACBCBAACCBABBBCBCABCBCBBCBCBCCACAACAAACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBBAAACACAACBCBCCAABAAACACBBCBAACCBBCCCBCAABBBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCBBABCABACBCBAACCBABBBCBCABCBCBBCBCBCCACAACAAACAC.exe" start= auto displayName= "UserDataSvc_ABBBBAAACACAACBCBCCAABAAACACBBCBAACCBBCCCBCAABBBACC"
  2⤵
  PID:1132
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBBBAAACACAACBCBCCAABAAACACBBCBAACCBBCCCBCAABBBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCBBABCABACBCBAACCBABBBCBCABCBCBBCBCBCCACAACAAACAC.exe" start= auto displayName= "UserDataSvc_ABBBBAAACACAACBCBCCAABAAACACBBCBAACCBBCCCBCAABBBACC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBBAAACACAACBCBCCAABAAACACBBCBAACCBBCCCBCAABBBACC"
  2⤵
  PID:6572
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBBBAAACACAACBCBCCAABAAACACBBCBAACCBBCCCBCAABBBACC"
    3⤵
    - Launches sc.exe
    PID:4712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAABCBCBCABCBABBACAAACCCBBCBCBACBABACCBCAACABCBBBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAABCBCBCABCBABBACAAACCCBBCBCBACBABACCBCAACABCBBBCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABAABACCCABCBCBBBBCAACACBCCCABACACACABCBBABCBCCBACCABBACBCCCCABACBAAAACBCAABCAACAAAABAAAACBCABBABABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBABBACACCBACACABACCCBACBABBCAACCACACBCCBCCACBBABCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABAABACCCABCBCBBBBCAACACBCCCABACACACABCBBABCBCCBACCABBACBCCCCABACBAAAACBCAABCAACAAAABAAAACBCABBABABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBABBACACCBACACABACCCBACBABBCAACCACACBCCBCCACBBABCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACBABCAABACBBABCBCBABACAACBBBBABBBBBBBCBACCCBCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBABBACACCBACACABACCCBACBABBCAACCACACBCCBCCACBBABCBAB.exe" start= auto displayName= "UserDataSvc_CCACBABCAABACBBABCBCBABACAACBBBBABBBBBBBCBACCCBCCBA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3756
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCACBABCAABACBBABCBCBABACAACBBBBABBBBBBBCBACCCBCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBABBACACCBACACABACCCBACBABBCAACCACACBCCBCCACBBABCBAB.exe" start= auto displayName= "UserDataSvc_CCACBABCAABACBBABCBCBABACAACBBBBABBBBBBBCBACCCBCCBA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACBABCAABACBBABCBCBABACAACBBBBABBBBBBBCBACCCBCCBA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6428
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCACBABCAABACBBABCBCBABACAACBBBBABBBBBBBCBACCCBCCBA"
    3⤵
    PID:1328

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBACCCBBAABBCCCCCCAABBCBAAAAACBBBAABCBAACABABACBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBACCCBBAABBCCCCCCAABBCBAAAAACBBBAABCBAACABABACBCB.exe
1⤵
- Executes dropped EXE
PID:568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBACCCBBBCABCAACABBAACCBBBBABCCAAABBCBAABCCABACBBCCACBCBBABAACBABAAAABCCCABCAACAAABACCCCBCCCBBBCCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBCCCABBCACCBCABCCBBBABBCCABACCCBCAACABCACCACCCCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBACCCBBBCABCAACABBAACCBBBBABCCAAABBCBAABCCABACBBCCACBCBBABAACBABAAAABCCCABCAACAAABACCCCBCCCBBBCCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBCCCABBCACCBCABCCBBBABBCCABACCCBCAACABCACCACCCCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBABABAACCAACBCCBACAABAAACCCABBACCCCCAAACCCCABBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBCCCABBCACCBCABCCBBBABBCCABACCCBCAACABCACCACCCCCCBA.exe" start= auto displayName= "UserDataSvc_CCBABABAACCAACBCCBACAABAAACCCABBACCCCCAAACCCCABBBCC"
  2⤵
  PID:5980
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBABABAACCAACBCCBACAABAAACCCABBACCCCCAAACCCCABBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBCCCABBCACCBCABCCBBBABBCCABACCCBCAACABCACCACCCCCCBA.exe" start= auto displayName= "UserDataSvc_CCBABABAACCAACBCCBACAABAAACCCABBACCCCCAAACCCCABBBCC"
    3⤵
    PID:7536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBABABAACCAACBCCBACAABAAACCCABBACCCCCAAACCCCABBBCC"
  2⤵
  PID:7296
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBABABAACCAACBCCBACAABAAACCCABBACCCCCAAACCCCABBBCC"
    3⤵
    - Launches sc.exe
    PID:8120

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBACCCBBAABBCCCCCCAABBCBAAAAACBBBAABCBAACABABACBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBACCCBBAABBCCCCCCAABBCBAAAAACBBBAABCBAACABABACBCB.exe
1⤵
- Executes dropped EXE
PID:4960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBCCCABBCACCBCABCCBBBABBCCABACCCBCAACABCACCACCCCCCBACACABCCAACBAAACBBABBCABCABBAAAACCCCACCAAACCCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBAAABBAACCCCBABBABBBAABCCACBCCBCBABABCCBCACBBACCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBCCCABBCACCBCABCCBBBABBCCABACCCBCAACABCACCACCCCCCBACACABCCAACBAAACBBABBCABCABBAAAACCCCACCAAACCCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBAAABBAACCCCBABBABBBAABCCACBCCBCBABABCCBCACBBACCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCAAABCAABCACBACCACBABBAACABBBABABAAAABACCCBCACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBAAABBAACCCCBABBABBBAABCCACBCCBCBABABCCBCACBBACCCB.exe" start= auto displayName= "UserDataSvc_ACCCAAABCAABCACBACCACBABBAACABBBABABAAAABACCCBCACCB"
  2⤵
  PID:8060
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCCAAABCAABCACBACCACBABBAACABBBABABAAAABACCCBCACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBAAABBAACCCCBABBABBBAABCCACBCCBCBABABCCBCACBBACCCB.exe" start= auto displayName= "UserDataSvc_ACCCAAABCAABCACBACCACBABBAACABBBABABAAAABACCCBCACCB"
    3⤵
    - Launches sc.exe
    PID:7572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCAAABCAABCACBACCACBABBAACABBBABABAAAABACCCBCACCB"
  2⤵
  PID:7232
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCCAAABCAABCACBACCACBABBAACABBBABABAAAABACCCBCACCB"
    3⤵
    PID:7580

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCCCCACABAAABABCACAAACBCACCACCBBACAABBCCACBBCACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCCCCACABAAABABCACAAACBCACCACCBBACAABBCCACBBCACABA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAAAACBACAACACABAABBCCCCCCABBCAABBBACABBCCACBCAAACBCABBACACABBCBCAAACBCACCBBACCACBBBABBBABBABCCCBBACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBBAABABABCCCAAAACBBBACCCCBBBAABBACABCCBCAAACACBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAAAACBACAACACABAABBCCCCCCABBCAABBBACABBCCACBCAAACBCABBACACABBCBCAAACBCACCBBACCACBBBABBBABBABCCCBBACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBBAABABABCCCAAAACBBBACCCCBBBAABBACABCCBCAAACACBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:7232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABCACCBACBCCBBCBBACCCCBCBACCBBBABCAAABACBCBACCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBBAABABABCCCAAAACBBBACCCCBBBAABBACABCCBCAAACACBACC.exe" start= auto displayName= "UserDataSvc_ACABCACCBACBCCBBCBBACCCCBCBACCBBBABCAAABACBCBACCBAB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7320
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABCACCBACBCCBBCBBACCCCBCBACCBBBABCAAABACBCBACCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBBAABABABCCCAAAACBBBACCCCBBBAABBACABCCBCAAACACBACC.exe" start= auto displayName= "UserDataSvc_ACABCACCBACBCCBBCBBACCCCBCBACCBBBABCAAABACBCBACCBAB"
    3⤵
    PID:7392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABCACCBACBCCBBCBBACCCCBCBACCBBBABCAAABACBCBACCBAB"
  2⤵
  PID:7452
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABCACCBACBCCBBCBBACCCCBCBACCBBBABCAAABACBCBACCBAB"
    3⤵
    - Launches sc.exe
    PID:7712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBACBBCCBABCAABAABAAAAACCABBABACBBBBCBBAABCAACBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBACBBCCBABCAABAABAAAAACCABBABACBBBBCBBAABCAACBACBC.exe
1⤵
- Executes dropped EXE
PID:1404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCACACAAABABBCBCCBBACABCBACACAAAACBCAACBBBCCCACCBACACBABCCBCAACAAACBBCCABCAABCCCBCACAACBAAABABAACBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBABCABCABBAAAAAACBBAABABAACBCCBAABACBBCACBABBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCACACAAABABBCBCCBBACABCBACACAAAACBCAACBBBCCCACCBACACBABCCBCAACAAACBBCCABCAABCCCBCACAACBAAABABAACBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBABCABCABBAAAAAACBBAABABAACBCCBAABACBBCACBABBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCBBBBCBBABCCACABBCABACCCABCAACBCACACAAABACCBBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBABCABCABBAAAAAACBBAABABAACBCCBAABACBBCACBABBABB.exe" start= auto displayName= "UserDataSvc_CABCBBBBCBBABCCACABBCABACCCABCAACBCACACAAABACCBBABB"
  2⤵
  PID:8092
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCBBBBCBBABCCACABBCABACCCABCAACBCACACAAABACCBBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBABCABCABBAAAAAACBBAABABAACBCCBAABACBBCACBABBABB.exe" start= auto displayName= "UserDataSvc_CABCBBBBCBBABCCACABBCABACCCABCAACBCACACAAABACCBBABB"
    3⤵
    PID:1864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCBBBBCBBABCCACABBCABACCCABCAACBCACACAAABACCBBABB"
  2⤵
  PID:7436
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCBBBBCBBABCCACABBCABACCCABCAACBCACACAAABACCBBABB"
    3⤵
    PID:7996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBACBBCCBABCAABAABAAAAACCABBABACBBBBCBBAABCAACBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBACBBCCBABCAABAABAAAAACCABBABACBBBBCBBAABCAACBACBC.exe
1⤵
- Executes dropped EXE
PID:6544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCCABCCBBAABAABACCAAACBAABCCCCBCAAACCCAACCCBAABCACBABABAAAABBCCBBBABACCAABABCCBABABCCCCACBBABABACABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBBCBBABAAAABBBAAACCACBBBCABBBCCBACBBAABAABBBCBCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCCABCCBBAABAABACCAAACBAABCCCCBCAAACCCAACCCBAABCACBABABAAAABBCCBBBABACCAABABCCBABABCCCCACBBABABACABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBBCBBABAAAABBBAAACCACBBBCABBBCCBACBBAABAABBBCBCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACAACBCCAAABACABBCCCBBACBBCBBCBCABAACCBACBAACCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBBCBBABAAAABBBAAACCACBBBCABBBCCBACBBAABAABBBCBCBBA.exe" start= auto displayName= "UserDataSvc_CAACAACBCCAAABACABBCCCBBACBBCBBCBCABAACCBACBAACCBCB"
  2⤵
  PID:8036
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAACAACBCCAAABACABBCCCBBACBBCBBCBCABAACCBACBAACCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBBCBBABAAAABBBAAACCACBBBCABBBCCBACBBAABAABBBCBCBBA.exe" start= auto displayName= "UserDataSvc_CAACAACBCCAAABACABBCCCBBACBBCBBCBCABAACCBACBAACCBCB"
    3⤵
    PID:8180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAACAACBCCAAABACABBCCCBBACBBCBBCBCABAACCBACBAACCBCB"
  2⤵
  PID:7192
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAACAACBCCAAABACABBCCCBBACBBCBBCBCABAACCBACBAACCBCB"
    3⤵
    PID:8004

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAACCAAAAAAAABBCACCBBACCACBBAAACBBCBBCABCCAAACBAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAACCAAAAAAAABBCACCBBACCACBBAAACBBCBBCABCCAAACBAABB.exe
1⤵
- Executes dropped EXE
PID:4720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAACCAABAABABCCBABCACCCCBBCAAACCACABACBBCBABBACCBACACBCACABABCACACCBCBABBCABCBCABAACAABCAABCACBAACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCACABBCACBBBBAAAAACACCBCACCCABCBAAABCBAAABACBCBCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAACCAABAABABCCBABCACCCCBBCAAACCACABACBBCBABBACCBACACBCACABABCACACCBCBABBCABCBCABAACAABCAABCACBAACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCACABBCACBBBBAAAAACACCBCACCCABCBAAABCBAAABACBCBCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:12120

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAACCAAAAAAAABBCACCBBACCACBBAAACBBCBBCABCCAAACBAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCAACCAAAAAAAABBCACCBBACCACBBAAACBBCBBCABCCAAACBAABB.exe
1⤵
- Executes dropped EXE
PID:1708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAACCAABAABABCCBABCACCCCBBCAAACCACABACBBCBABBACCBACACBCACABABCACACCBCBABBCABCBCABAACAABCAABCACBAACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAAABAACAABCCCACAACBBBCCAACAACAACABCABCAABBCABACCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAACCAABAABABCCBABCACCCCBBCAAACCACABACBBCBABBACCBACACBCACABABCACACCBCBABBCABCBCABAACAABCAABCACBAACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAAABAACAABCCCACAACBBBCCAACAACAACABCABCAABBCABACCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:12128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACACACCBBCACBACCCBAAACAAABBAACCABBABABCAAACCAABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAAABAACAABCCCACAACBBBCCAACAACAACABCABCAABBCABACCCC.exe" start= auto displayName= "UserDataSvc_CACACACCBBCACBACCCBAAACAAABBAACCABBABABCAAACCAABBAC"
  2⤵
  PID:10972
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACACACCBBCACBACCCBAAACAAABBAACCABBABABCAAACCAABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAAABAACAABCCCACAACBBBCCAACAACAACABCABCAABBCABACCCC.exe" start= auto displayName= "UserDataSvc_CACACACCBBCACBACCCBAAACAAABBAACCABBABABCAAACCAABBAC"
    3⤵
    PID:13260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACACACCBBCACBACCCBAAACAAABBAACCABBABABCAAACCAABBAC"
  2⤵
  PID:8740
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACACACCBBCACBACCCBAAACAAABBAACCABBABABCAAACCAABBAC"
    3⤵
    - Launches sc.exe
    PID:5472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBABBAABCCABCACCCAACACAABABABACCCBCCACBBCBAAACCBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBABBAABCCABCACCCAACACAABABABACCCBCCACBBCBAAACCBBBA.exe
1⤵
- Executes dropped EXE
PID:3888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBABBCBCABAACABACABBACCBBCCCBCCACCABBCCBCACBCCCBBBBACBCCCCBAAABBCACCACBCCAACBABAABBAABCBABACBBBCCAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBABACBCBAACACCBAABAABACCBCABBABCBCBACCBAAABCBBCACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBABBCBCABAACABACABBACCBBCCCBCCACCABBCCBCACBCCCBBBBACBCCCCBAAABBCACCACBCCAACBABAABBAABCBABACBBBCCAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBABACBCBAACACCBAABAABACCBCABBABCBCBACCBAAABCBBCACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11872

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBABBAABCCABCACCCAACACAABABABACCCBCCACBBCBAAACCBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBABBAABCCABCACCCAACACAABABABACCCBCCACBBCBAAACCBBBA.exe
1⤵
- Executes dropped EXE
PID:7092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACBBBACACCBBAABBCCABBBBAABAABABBCCCCCACAACBBAACBCACBBCACACCABCBABAABBBAACAABCBBBBACAABCACACBBCACCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBAACCBBACBBBCCCABCCABBABCBBCCCBABABBAAACABCCBABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACBBBACACCBBAABBCCABBBBAABAABABBCCCCCACAACBBAACBCACBBCACACCABCBABAABBBAACAABCBBBBACAABCACACBBCACCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBAACCBBACBBBCCCABCCABBABCBBCCCBABABBAAACABCCBABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCCAABACABAAABCABCCABABCBCACAAABBBACACCBACBAAACBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBAACCBBACBBBCCCABCCABBABCBBCCCBABABBAAACABCCBABCBA.exe" start= auto displayName= "UserDataSvc_ABCCAABACABAAABCABCCABABCBCACAAABBBACACCBACBAAACBBA"
  2⤵
  PID:6260
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCCAABACABAAABCABCCABABCBCACAAABBBACACCBACBAAACBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBAACCBBACBBBCCCABCCABBABCBBCCCBABABBAAACABCCBABCBA.exe" start= auto displayName= "UserDataSvc_ABCCAABACABAAABCABCCABABCBCACAAABBBACACCBACBAAACBBA"
    3⤵
    PID:6692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCCAABACABAAABCABCCABABCBCACAAABBBACACCBACBAAACBBA"
  2⤵
  PID:7416
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCCAABACABAAABCABCCABABCBCACAAABBBACACCBACBAAACBBA"
    3⤵
    PID:13368

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCBBABCABACBCBAACCBABBBCBCABCBCBBCBCBCCACAACAAACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCBBABCABACBCBAACCBABBBCBCABCBCBBCBCBCCACAACAAACAC.exe
1⤵
- Executes dropped EXE
PID:5768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACBCCCBCBCCACACBCCBCBABBACABBBBBACBACABCCCACACABACCBABBCACBCCCCCCCBCCBABBCCCAACCCBBBACCBBCCABCBCACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAAACCCABBBACABBCACBCBBCBCABAABACAACBCCCCBAAAACCCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACBCCCBCBCCACACBCCBCBABBACABBBBBACBACABCCCACACABACCBABBCACBCCCCCCCBCCBABBCCCAACCCBBBACCBBCCABCBCACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAAACCCABBBACABBCACBCBBCBCABAABACAACBCCCCBAAAACCCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:12884

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCBBABCABACBCBAACCBABBBCBCABCBCBBCBCBCCACAACAAACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBABCBBABCABACBCBAACCBABBBCBCABCBCBBCBCBCCACAACAAACAC.exe
1⤵
- Executes dropped EXE
PID:4128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCBCBCACBAACCACBCBBCAAAAACCBAAAAABCACABCACBCACCCCBAABACBBBCCACAABBAAABBBCBBBBCCCCACBCBBBCABBBABABCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACCBACCBCBABABBAAABABCACCABABCCBABBAACCCBABBCCBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCBCBCACBAACCACBCBBCAAAAACCBAAAAABCACABCACBCACCCCBAABACBBBCCACAABBAAABBBCBBBBCCCCACBCBBBCABBBABABCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACCBACCBCBABABBAAABABCACCABABCCBABBAACCCBABBCCBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:12944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBBCCAAACBCACABBCABCABCBBCBACBCBBACABBABACAABCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACCBACCBCBABABBAAABABCACCABABCCBABBAACCCBABBCCBCBA.exe" start= auto displayName= "UserDataSvc_ABBBBCCAAACBCACABBCABCABCBBCBACBCBBACABBABACAABCABB"
  2⤵
  PID:11796
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBBBCCAAACBCACABBCABCABCBBCBACBCBBACABBABACAABCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACCBACCBCBABABBAAABABCACCABABCCBABBAACCCBABBCCBCBA.exe" start= auto displayName= "UserDataSvc_ABBBBCCAAACBCACABBCABCABCBBCBACBCBBACABBABACAABCABB"
    3⤵
    PID:7180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBBCCAAACBCACABBCABCABCBBCBACBCBBACABBABACAABCABB"
  2⤵
  PID:11452

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBABBACACCBACACABACCCBACBABBCAACCACACBCCBCCACBBABCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBABBACACCBACACABACCCBACBABBCAACCACACBCCBCCACBBABCBAB.exe
1⤵
- Executes dropped EXE
PID:4708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCBCCBCABCABBCCCCAACCCBCCAAACBABCBCBBBBBCBBCCABABCCBACCCBAACCCBACBBBAAACAABAABCBCBAACACBCCACCCCACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCBCABABCAAABACBCABABACCABABCACACBACCBACABAABBABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCBCCBCABCABBCCCCAACCCBCCAAACBABCBCBBBBBCBBCCABABCCBACCCBAACCCBACBBBAAACAABAABCBCBAACACBCCACCCCACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCBCABABCAAABACBCABABACCABABCACACBACCBACABAABBABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:8284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCCABBCCABBACBACAAAACACBACBBACBBABACAABBBCCBAACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCBCABABCAAABACBCABABACCABABCACACBACCBACABAABBABCBC.exe" start= auto displayName= "UserDataSvc_CCCCCABBCCABBACBACAAAACACBACBBACBBABACAABBBCCBAACCA"
  2⤵
  PID:8424
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCCABBCCABBACBACAAAACACBACBBACBBABACAABBBCCBAACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCBCABABCAAABACBCABABACCABABCACACBACCBACABAABBABCBC.exe" start= auto displayName= "UserDataSvc_CCCCCABBCCABBACBACAAAACACBACBBACBBABACAABBBCCBAACCA"
    3⤵
    - Launches sc.exe
    PID:8560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCCABBCCABBACBACAAAACACBACBBACBBABACAABBBCCBAACCA"
  2⤵
  PID:8700
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCCABBCCABBACBACAAAACACBACBBACBBABACAABBBCCBAACCA"
    3⤵
    PID:8812

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABAACABBABACBCCCBABBACBBCCCBBAABCBBBAABBABBBACBACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABAACABBABACBCCCBABBACBBCCCBBAABCBBBAABBABBBACBACBCA.exe
1⤵
- Executes dropped EXE
PID:2252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBCACCACCBABACCCCBBCABACCCBCBCBACAABBBBCABCBCBBCBCCCBBBCBBCCBBABACAABBBBBBBAACCBACAAABBCCCABCACCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABCACBCBACAACAACABCAAAACBBABCBBACBAACBCAABACACCBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBCACCACCBABACCCCBBCABACCCBCBCBACAABBBBCABCBCBBCBCCCBBBCBBCCBBABACAABBBBBBBAACCBACAAABBCCCABCACCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABCACBCBACAACAACABCAAAACBBABCBBACBAACBCAABACACCBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAACBCCBAACBABBAAACBABBABBCCBCCCABCBACCABCBBABBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABCACBCBACAACAACABCAAAACBBABCBBACBAACBCAABACACCBBAC.exe" start= auto displayName= "UserDataSvc_BCAACBCCBAACBABBAAACBABBABBCCBCCCABCBACCABCBBABBBBC"
  2⤵
  PID:8248
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCAACBCCBAACBABBAAACBABBABBCCBCCCABCBACCABCBBABBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABCACBCBACAACAACABCAAAACBBABCBBACBAACBCAABACACCBBAC.exe" start= auto displayName= "UserDataSvc_BCAACBCCBAACBABBAAACBABBABBCCBCCCABCBACCABCBBABBBBC"
    3⤵
    PID:1416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAACBCCBAACBABBAAACBABBABBCCBCCCABCBACCABCBBABBBBC"
  2⤵
  PID:8904
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCAACBCCBAACBABBAAACBABBABBCCBCCCABCBACCABCBBABBBBC"
    3⤵
    - Launches sc.exe
    PID:1264

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABAACABBABACBCCCBABBACBBCCCBBAABCBBBAABBABBBACBACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABAACABBABACBCCCBABBACBBCCCBBAABCBBBAABBABBBACBACBCA.exe
1⤵
- Executes dropped EXE
PID:4500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACAACAACBBAABAAAACBBCCAACCABBBBBBACBCAAAABBCBCACAAAAACCBCBBCAACAAAAAAAACBAAAAAAABCCCAABCAAAAACBBAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCBCBABBAABCBCACBCCCCBCACBBBCCACBCCACBBACCBAABBABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACAACAACBBAABAAAACBBCCAACCABBBBBBACBCAAAABBCBCACAAAAACCBCBBCAACAAAAAAAACBAAAAAAABCCCAABCAAAAACBBAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCBCBABBAABCBCACBCCCCBCACBBBCCACBCCACBBACCBAABBABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:9192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABBBCABABBCCBACBABABCBCCAABACBBBACCCCABABCCCBCCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCBCBABBAABCBCACBCCCCBCACBBBCCACBCCACBBACCBAABBABCB.exe" start= auto displayName= "UserDataSvc_BABBBCABABBCCBACBABABCBCCAABACBBBACCCCABABCCCBCCCCB"
  2⤵
  PID:4296
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABBBCABABBCCBACBABABCBCCAABACBBBACCCCABABCCCBCCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCBCBABBAABCBCACBCCCCBCACBBBCCACBCCACBBACCBAABBABCB.exe" start= auto displayName= "UserDataSvc_BABBBCABABBCCBACBABABCBCCAABACBBBACCCCABABCCCBCCCCB"
    3⤵
    PID:8652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABBBCABABBCCBACBABABCBCCAABACBBBACCCCABABCCCBCCCCB"
  2⤵
  PID:6140
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABBBCABABBCCBACBABABCBCCAABACBBBACCCCABABCCCBCCCCB"
    3⤵
    PID:8652

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCBAAAACBABBCAAACABCCCAABBACCBAAABCACCBABCBBABBBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCBAAAACBABBCAAACABCCCAABBACCBAAABCACCBABCBBABBBBCA.exe
1⤵
- Executes dropped EXE
PID:7176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBACBCACBCABBAABCCCABBCCBCCBBBABBAABACCBBCBCBABCABCACBCACCABBBBBACCAACBACCACABABCBBBCBBBBAACBCBABCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCABBBBAAACABAACBCABCCACAABCCBBACBACAAAABCBCBCBBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBACBCACBCABBAABCCCABBCCBCCBBBABBAABACCBBCBCBABCABCACBCACCABBBBBACCAACBACCACABABCBBBCBBBBAACBCBABCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCABBBBAAACABAACBCABCCACAABCCBBACBACAAAABCBCBCBBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBABCBCBABBACBCBACAAAACCBCAABBAACCABACACBBBBBAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCABBBBAAACABAACBCABCCACAABCCBBACBACAAAABCBCBCBBCBC.exe" start= auto displayName= "UserDataSvc_AABBABCBCBABBACBCBACAAAACCBCAABBAACCABACACBBBBBAAAC"
  2⤵
  PID:4332
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBABCBCBABBACBCBACAAAACCBCAABBAACCABACACBBBBBAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCABBBBAAACABAACBCABCCACAABCCBBACBACAAAABCBCBCBBCBC.exe" start= auto displayName= "UserDataSvc_AABBABCBCBABBACBCBACAAAACCBCAABBAACCABACACBBBBBAAAC"
    3⤵
    - Launches sc.exe
    PID:9200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBABCBCBABBACBCBACAAAACCBCAABBAACCABACACBBBBBAAAC"
  2⤵
  PID:8544
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBABCBCBABBACBCBACAAAACCBCAABBAACCABACACBBBBBAAAC"
    3⤵
    PID:5472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCBAAAACBABBCAAACABCCCAABBACCBAAABCACCBABCBBABBBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCBAAAACBABBCAAACABCCCAABBACCBAAABCACCBABCBBABBBBCA.exe
1⤵
- Executes dropped EXE
PID:5452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCCABBBABCACBBBCAABCCACACAAACABAAACBCACAAACBCBACACBBBCBCCBBCAACBCBCBBBBBCCCCBAAACBABCBCACABAABAABCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBBCBABCAACCCCABACBBBCAABCAAABCABABAACACAABBBCAACBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCCABBBABCACBBBCAABCCACACAAACABAAACBCACAAACBCBACACBBBCBCCBBCAACBCBCBBBBBCCCCBAAACBABCBCACABAABAABCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBBCBABCAACCCCABACBBBCAABCAAABCABABAACACAABBBCAACBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:7752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBCBBCBACBCCBCCBCABABACCBBBBBCBBACCACCACCACCABCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBBCBABCAACCCCABACBBBCAABCAAABCABABAACACAABBBCAACBBA.exe" start= auto displayName= "UserDataSvc_BCCBCBBCBACBCCBCCBCABABACCBBBBBCBBACCACCACCACCABCAC"
  2⤵
  PID:8260
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBCBBCBACBCCBCCBCABABACCBBBBBCBBACCACCACCACCABCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBBCBABCAACCCCABACBBBCAABCAAABCABABAACACAABBBCAACBBA.exe" start= auto displayName= "UserDataSvc_BCCBCBBCBACBCCBCCBCABABACCBBBBBCBBACCACCACCACCABCAC"
    3⤵
    PID:3744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBCBBCBACBCCBCCBCABABACCBBBBBCBBACCACCACCACCABCAC"
  2⤵
  PID:9124
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBCBBCBACBCCBCCBCABABACCBBBBBCBBACCACCACCACCABCAC"
    3⤵
    PID:8876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABBBBCACBBBCBBCAAAAABCCCCCABABAAABCBCCBCBBACCACAABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABBBBCACBBBCBBCAAAAABCCCCCABABAAABCBCCBCBBACCACAABBA.exe
1⤵
PID:7384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACCCBACBCABAABBBBACCACCCBACBBCACCBBAAACAABAAABCCCABCCBBABBCCABCCBCABBACCCACBCCACAABCBBAAABABBABCAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCBBACCABBACBBBACAABAABBCAACCABCBABCBABBBBCBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACCCBACBCABAABBBBACCACCCBACBBCACCBBAAACAABAAABCCCABCCBBABBCCABCCBCABBACCCACBCCACAABCBBAAABABBABCAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCBBACCABBACBBBACAABAABBCAACCABCBABCBABBBBCBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABABACBCCCBABAAABBBBBBABBACBCCCABBAAAAABCCCACACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCBBACCABBACBBBACAABAABBCAACCABCBABCBABBBBCBCCC.exe" start= auto displayName= "UserDataSvc_BAABABACBCCCBABAAABBBBBBABBACBCCCABBAAAAABCCCACACCB"
  2⤵
  PID:9400
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABABACBCCCBABAAABBBBBBABBACBCCCABBAAAAABCCCACACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCBBACCABBACBBBACAABAABBCAACCABCBABCBABBBBCBCCC.exe" start= auto displayName= "UserDataSvc_BAABABACBCCCBABAAABBBBBBABBACBCCCABBAAAAABCCCACACCB"
    3⤵
    PID:9556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABABACBCCCBABAAABBBBBBABBACBCCCABBAAAAABCCCACACCB"
  2⤵
  PID:9600
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABABACBCCCBABAAABBBBBBABBACBCCCABBAAAAABCCCACACCB"
    3⤵
    - Launches sc.exe
    PID:9732

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABBBBCACBBBCBBCAAAAABCCCCCABABAAABCBCCBCBBACCACAABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABBBBCACBBBCBBCAAAAABCCCCCABABAAABCBCCBCBBACCACAABBA.exe
1⤵
PID:7672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACCBBBABAABBBCABACABBCCABCBABCCABBBCABCCABBBCACCBBACBCCACBBAAAAACAAACBCBCBCBCCBAAABBABAACCBACCABAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAABBBCBCCAABCBCBBBACABCBCACACABCBBBCBCAAAACAAAABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACCBBBABAABBBCABACABBCCABCBABCCABBBCABCCABBBCACCBBACBCCACBBAAAAACAAACBCBCBCBCCBAAABBABAACCBACCABAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAABBBCBCCAABCBCBBBACABCBCACACABCBBBCBCAAAACAAAABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAABAABAAAACBACABACCCACCCBABCBACBBACAACCBAACABCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAABBBCBCCAABCBCBBBACABCBCACACABCBBBCBCAAAACAAAABACB.exe" start= auto displayName= "UserDataSvc_CAAABAABAAAACBACABACCCACCCBABCBACBBACAACCBAACABCCAB"
  2⤵
  PID:9836
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAABAABAAAACBACABACCCACCCBABCBACBBACAACCBAACABCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAABBBCBCCAABCBCBBBACABCBCACACABCBBBCBCAAAACAAAABACB.exe" start= auto displayName= "UserDataSvc_CAAABAABAAAACBACABACCCACCCBABCBACBBACAACCBAACABCCAB"
    3⤵
    - Launches sc.exe
    PID:9884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAABAABAAAACBACABACCCACCCBABCBACBBACAACCBAACABCCAB"
  2⤵
  PID:9908
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAABAABAAAACBACABACCCACCCBABCBACBBACAACCBAACABCCAB"
    3⤵
    - Launches sc.exe
    PID:9948

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBBAABABABCCCAAAACBBBACCCCBBBAABBACABCCBCAAACACBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBBAABABABCCCAAAACBBBACCCCBBBAABBACABCCBCAAACACBACC.exe
1⤵
PID:7948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBACCBCCACCACAAAABBBBCBAABAAABBCCAAAAABAAABCBCABBBABBCBBACACABACCAACAAACAAABBBBBCBBABBBCBAABBBBCCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACBABABABBCBCBABBBBCCCCACCABACBCBBBCBCBBBBABCACBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBACCBCCACCACAAAABBBBCBAABAAABBCCAAAAABAAABCBCABBBABBCBBACACABACCAACAAACAAABBBBBCBBABBBCBAABBBBCCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACBABABABBCBCBABBBBCCCCACCABACBCBBBCBCBBBBABCACBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBBBBBBBCCAACBCBAABCCCACBCCAAABBAACCAABACBCACBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACBABABABBCBCBABBBBCCCCACCABACBCBBBCBCBBBBABCACBACA.exe" start= auto displayName= "UserDataSvc_ABBBBBBBBBCCAACBCBAABCCCACBCCAAABBAACCAABACBCACBBBA"
  2⤵
  PID:5816
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBBBBBBBBCCAACBCBAABCCCACBCCAAABBAACCAABACBCACBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACBABABABBCBCBABBBBCCCCACCABACBCBBBCBCBBBBABCACBACA.exe" start= auto displayName= "UserDataSvc_ABBBBBBBBBCCAACBCBAABCCCACBCCAAABBAACCAABACBCACBBBA"
    3⤵
    PID:8276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBBBBBBBCCAACBCBAABCCCACBCCAAABBAACCAABACBCACBBBA"
  2⤵
  PID:4340
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBBBBBBBBCCAACBCBAABCCCACBCCAAABBAACCAABACBCACBBBA"
    3⤵
    - Launches sc.exe
    PID:8680

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBBAABABABCCCAAAACBBBACCCCBBBAABBACABCCBCAAACACBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBBAABABABCCCAAAACBBBACCCCBBBAABBACABCCBCAAACACBACC.exe
1⤵
PID:7956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBACCBCCACCACAAAABBBBCBAABAAABBCCAAAAABAAABCBCABBBABBCBBACACABACCAACAAACAAABBBBBCBBABBBCBAABBBBCCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBACCBCCACCACAAAABBBBCBAABAAABBCCAAAAABAAABCBCABBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBACCBCCACCACAAAABBBBCBAABAAABBCCAAAAABAAABCBCABBBABBCBBACACABACCAACAAACAAABBBBBCBBABBBCBAABBBBCCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBACCBCCACCACAAAABBBBCBAABAAABBCCAAAAABAAABCBCABBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBABCBABBCCBBCBABBCACBBBAAACBBBBABBBCACAACBAACAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBACCBCCACCACAAAABBBBCBAABAAABBCCAAAAABAAABCBCABBBAB.exe" start= auto displayName= "UserDataSvc_BCBBABCBABBCCBBCBABBCACBBBAAACBBBBABBBCACAACBAACAAA"
  2⤵
  PID:8344
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBABCBABBCCBBCBABBCACBBBAAACBBBBABBBCACAACBAACAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBACCBCCACCACAAAABBBBCBAABAAABBCCAAAAABAAABCBCABBBAB.exe" start= auto displayName= "UserDataSvc_BCBBABCBABBCCBBCBABBCACBBBAAACBBBBABBBCACAACBAACAAA"
    3⤵
    PID:2200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBABCBABBCCBBCBABBCACBBBAAACBBBBABBBCACAACBAACAAA"
  2⤵
  PID:1640
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBABCBABBCCBBCBABBCACBBBAAACBBBBABBBCACAACBAACAAA"
    3⤵
    - Launches sc.exe
    PID:6152

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBBACACCCCBCABCABAAACABCAAABACAAACBBABBBABABBCBCAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBBACACCCCBCABCABAAACABCAAABACAAACBBABBBABABBCBCAABA.exe
1⤵
PID:7352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBACCACCCACCCABCCACCACCAABBCBCBACCBACCACACBBCABBCAAAACBBCCCCAACCACCAACBBBACBABBACAABBACBABCAACCBBABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBAACBBBCCAAAACBBCBCCBCCBBCABABAACCBACCBBABBAAAAACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBACCACCCACCCABCCACCACCAABBCBCBACCBACCACACBBCABBCAAAACBBCCCCAACCACCAACBBBACBABBACAABBACBABCAACCBBABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBAACBBBCCAAAACBBCBCCBCCBBCABABAACCBACCBBABBAAAAACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCCACBBCABCABACAAACCCBBCABCCABCAACCBCABCBCACBAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBAACBBBCCAAAACBBCBCCBCCBBCABABAACCBACCBBABBAAAAACCBA.exe" start= auto displayName= "UserDataSvc_CCCCCACBBCABCABACAAACCCBBCABCCABCAACCBCABCBCACBAABC"
  2⤵
  PID:9236
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCCACBBCABCABACAAACCCBBCABCCABCAACCBCABCBCACBAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBAACBBBCCAAAACBBCBCCBCCBBCABABAACCBACCBBABBAAAAACCBA.exe" start= auto displayName= "UserDataSvc_CCCCCACBBCABCABACAAACCCBBCABCCABCAACCBCABCBCACBAABC"
    3⤵
    - Launches sc.exe
    PID:9296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCCACBBCABCABACAAACCCBBCABCCABCAACCBCABCBCACBAABC"
  2⤵
  PID:9476
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCCACBBCABCABACAAACCCBBCABCCABCAACCBCABCBCACBAABC"
    3⤵
    PID:9572

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBBCBBABAAAABBBAAACCACBBBCABBBCCBACBBAABAABBBCBCBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBBCBBABAAAABBBAAACCACBBBCABBBCCBACBBAABAABBBCBCBBA.exe
1⤵
PID:7832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBABABAABCCCCBCCCABBABCABCBBBACBABBBBBCCAAACBCBAACACACCABAACCCCAABCAABBBCCBBACCCCCBBAAABACACCAACBACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABBABAACAAABABCABACAACCCABCCABCCBAABCBABCACCCACBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBABABAABCCCCBCCCABBABCABCBBBACBABBBBBCCAAACBCBAACACACCABAACCCCAABCAABBBCCBBACCCCCBBAAABACACCAACBACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABBABAACAAABABCABACAACCCABCCABCCBAABCBABCACCCACBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:10220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCBACAABCCCCBABCBBBCBBACCBCBBBBBAABCCBBCCCCCACCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABBABAACAAABABCABACAACCCABCCABCCBAABCBABCACCCACBBA.exe" start= auto displayName= "UserDataSvc_BCBCBACAABCCCCBABCBBBCBBACCBCBBBBBAABCCBBCCCCCACCCC"
  2⤵
  PID:9184
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCBACAABCCCCBABCBBBCBBACCBCBBBBBAABCCBBCCCCCACCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABBABAACAAABABCABACAACCCABCCABCCBAABCBABCACCCACBBA.exe" start= auto displayName= "UserDataSvc_BCBCBACAABCCCCBABCBBBCBBACCBCBBBBBAABCCBBCCCCCACCCC"
    3⤵
    PID:9280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCBACAABCCCCBABCBBBCBBACCBCBBBBBAABCCBBCCCCCACCCC"
  2⤵
  PID:9920
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCBACAABCCCCBABCBBBCBBACCBCBBBBBAABCCBBCCCCCACCCC"
    3⤵
    - Launches sc.exe
    PID:1060

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBBCBBABAAAABBBAAACCACBBBCABBBCCBACBBAABAABBBCBCBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBBCBBABAAAABBBAAACCACBBBCABBBCCBACBBAABAABBBCBCBBA.exe
1⤵
PID:7868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCBCACCACCCAABCACCAABAAAACBBBABCBBCCCCACCACBBAABBBBAAAACCBCBCAABBCBCBCCABBBCAACCBBABCCBCACCBAACCBACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACAABBACBCACCAACCBABAAACAABCBBBCAAABCACBCBBACCBCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCBCACCACCCAABCACCAABAAAACBBBABCBBCCCCACCACBBAABBBBAAAACCBCBCAABBCBCBCCABBBCAACCBBABCCBCACCBAACCBACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACAABBACBCACCAACCBABAAACAABCBBBCAAABCACBCBBACCBCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCABACCCBCCBBBBBCCCBABBBCBAABABCCCABBACABABCACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACAABBACBCACCAACCBABAAACAABCBBBCAAABCACBCBBACCBCCCA.exe" start= auto displayName= "UserDataSvc_AABCABACCCBCCBBBBBCCCBABBBCBAABABCCCABBACABABCACCBB"
  2⤵
  PID:9292
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCABACCCBCCBBBBBCCCBABBBCBAABABCCCABBACABABCACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACAABBACBCACCAACCBABAAACAABCBBBCAAABCACBCBBACCBCCCA.exe" start= auto displayName= "UserDataSvc_AABCABACCCBCCBBBBBCCCBABBBCBAABABCCCABBACABABCACCBB"
    3⤵
    - Launches sc.exe
    PID:9888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCABACCCBCCBBBBBCCCBABBBCBAABABCCCABBACABABCACCBB"
  2⤵
  PID:10168
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCABACCCBCCBBBBBCCCBABBBCBAABABCCCABBACABABCACCBB"
    3⤵
    - Launches sc.exe
    PID:9484

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBABCABCABBAAAAAACBBAABABAACBCCBAABACBBCACBABBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBABCABCABBAAAAAACBBAABABAACBCCBAABACBBCACBABBABB.exe
1⤵
PID:8144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBBAABBCCACCBCCABBABACABCCCABBAAACCCAAACBBAABAACCBBCCCAACCCCCBBBCCBAACBCBCCCCBCACBCAABBACCBCCCABCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBABCCAACAABACBABABABBAABCBBBABAAAACBBBBBCBCACABBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBBAABBCCACCBCCABBABACABCCCABBAAACCCAAACBBAABAACCBBCCCAACCCCCBBBCCBAACBCBCCCCBCACBCAABBACCBCCCABCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBABCCAACAABACBABABABBAABCBBBABAAAACBBBBBCBCACABBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCACACBACBCCCCBAACCABBACCABCBACBCCAABBAACBBCAACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBABCCAACAABACBABABABBAABCBBBABAAAACBBBBBCBCACABBCAC.exe" start= auto displayName= "UserDataSvc_CBCCACACBACBCCCCBAACCABBACCABCBACBCCAABBAACBBCAACAC"
  2⤵
  PID:11004
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCACACBACBCCCCBAACCABBACCABCBACBCCAABBAACBBCAACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBABCCAACAABACBABABABBAABCBBBABAAAACBBBBBCBCACABBCAC.exe" start= auto displayName= "UserDataSvc_CBCCACACBACBCCCCBAACCABBACCABCBACBCCAABBAACBBCAACAC"
    3⤵
    PID:10296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCACACBACBCCCCBAACCABBACCABCBACBCCAABBAACBBCAACAC"
  2⤵
  PID:12008
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCCACACBACBCCCCBAACCABBACCABCBACBCCAABBAACBBCAACAC"
    3⤵
    - Launches sc.exe
    PID:4588

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBABCABCABBAAAAAACBBAABABAACBCCBAABACBBCACBABBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBBABCABCABBAAAAAACBBAABABAACBCCBAABACBBCACBABBABB.exe
1⤵
PID:7228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBCCCACAAACAABACBCBCABBBCBCBBCACACCABCCAACAACABACCBCBCBCBCACCBAABBBBBBCBBAAABAABACCCBCBACBACBCBBABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACAACBAACBACBCCAABCCCACBAABACCCCCACACCCCABBBBCBCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBCCCACAAACAABACBCBCABBBCBCBBCACACCABCCAACAACABACCBCBCBCBCACCBAABBBBBBCBBAAABAABACCCBCBACBACBCBBABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACAACBAACBACBCCAABCCCACBAABACCCCCACACCCCABBBBCBCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACAAAACABCCCABCAABCBCAAAABBBACBAACBBCCABACCACBCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACAACBAACBACBCCAABCCCACBAABACCCCCACACCCCABBBBCBCAAC.exe" start= auto displayName= "UserDataSvc_BACAAAACABCCCABCAABCBCAAAABBBACBAACBBCCABACCACBCABC"
  2⤵
  PID:10428
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACAAAACABCCCABCAABCBCAAAABBBACBAACBBCCABACCACBCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACAACBAACBACBCCAABCCCACBAABACCCCCACACCCCABBBBCBCAAC.exe" start= auto displayName= "UserDataSvc_BACAAAACABCCCABCAABCBCAAAABBBACBAACBBCCABACCACBCABC"
    3⤵
    - Launches sc.exe
    PID:11000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACAAAACABCCCABCAABCBCAAAABBBACBAACBBCCABACCACBCABC"
  2⤵
  PID:12208
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACAAAACABCCCABCAABCBCAAAABBBACBAACBBCCABACCACBCABC"
    3⤵
    PID:12120

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBAAABBAACCCCBABBABBBAABCCACBCCBCBABABCCBCACBBACCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBAAABBAACCCCBABBABBBAABCCACBCCBCBABABCCBCACBBACCCB.exe
1⤵
PID:7800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCCCACABBCBBACBBCCACBCCAAACAACAACCBCACBBCACBCBCABBACBCBCACBBCCCCACBCCCACABAACCCBCAAABBCCAACCCCBCCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCCABBBAABACBCBBCBACACBCCBAABABCABABACAAACABCAABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCCCACABBCBBACBBCCACBCCAAACAACAACCBCACBBCACBCBCABBACBCBCACBBCCCCACBCCCACABAACCCBCAAABBCCAACCCCBCCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCCABBBAABACBCBBCBACACBCCBAABABCABABACAAACABCAABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCAAAABABCBCCACACABCBACACABBBAAABCACACCBBBCBBBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCCABBBAABACBCBBCBACACBCCBAABABCABABACAAACABCAABAA.exe" start= auto displayName= "UserDataSvc_CCCCAAAABABCBCCACACABCBACACABBBAAABCACACCBBBCBBBAAA"
  2⤵
  PID:11856
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCAAAABABCBCCACACABCBACACABBBAAABCACACCBBBCBBBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCCABBBAABACBCBBCBACACBCCBAABABCABABACAAACABCAABAA.exe" start= auto displayName= "UserDataSvc_CCCCAAAABABCBCCACACABCBACACABBBAAABCACACCBBBCBBBAAA"
    3⤵
    - Launches sc.exe
    PID:4600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCAAAABABCBCCACACABCBACACABBBAAABCACACCBBBCBBBAAA"
  2⤵
  PID:13084
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCAAAABABCBCCACACABCBACACABBBAAABCACACCBBBCBBBAAA"
    3⤵
    - Launches sc.exe
    PID:2372

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBAAABBAACCCCBABBABBBAABCCACBCCBCBABABCCBCACBBACCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBAAABBAACCCCBABBABBBAABCCACBCCBCBABABCCBCACBBACCCB.exe
1⤵
PID:7560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAACCCACBABCCAABCCBBCCAABACACACBBAABBBABBABACCCCCABCCBAAABABACACAACACCACABCCACCACBCCBBABCCCCCAACABBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCCAACAABBCABAAACABCAACACBCCBBBBAAACAACBCACAAACAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAACCCACBABCCAABCCBBCCAABACACACBBAABBBABBABACCCCCABCCBAAABABACACAACACCACABCCACCACBCCBBABCCCCCAACABBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCCAACAABBCABAAACABCAACACBCCBBBBAAACAACBCACAAACAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:12244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACCBABBBCCABCBCBBBCCCCCBCBBBCAABBCABABABCCCBBBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCCAACAABBCABAAACABCAACACBCCBBBBAAACAACBCACAAACAAAB.exe" start= auto displayName= "UserDataSvc_CAACCBABBBCCABCBCBBBCCCCCBCBBBCAABBCABABABCCCBBBACC"
  2⤵
  PID:12360
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAACCBABBBCCABCBCBBBCCCCCBCBBBCAABBCABABABCCCBBBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCCAACAABBCABAAACABCAACACBCCBBBBAAACAACBCACAAACAAAB.exe" start= auto displayName= "UserDataSvc_CAACCBABBBCCABCBCBBBCCCCCBCBBBCAABBCABABABCCCBBBACC"
    3⤵
    - Launches sc.exe
    PID:12020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAACCBABBBCCABCBCBBBCCCCCBCBBBCAABBCABABABCCCBBBACC"
  2⤵
  PID:6340

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBCCCABBCACCBCABCCBBBABBCCABACCCBCAACABCACCACCCCCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBCCCABBCACCBCABCCBBBABBCCABACCCBCAACABCACCACCCCCCBA.exe
1⤵
PID:8104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBCCCABBCCACACABBBBBCAACACCBACBBABBCBBBCABBCBABACCAABACCCBABABCCBBCBBBBCABBBBCBCAACCACCBBBBABBBCCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBBBCCCBBBCBCBBBCBCCCBBCACCBCCACBCCBACACACACABBCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBCCCABBCCACACABBBBBCAACACCBACBBABBCBBBCABBCBABACCAABACCCBABABCCBBCBBBBCABBBBCBCAACCACCBBBBABBBCCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBBBCCCBBBCBCBBBCBCCCBBCACCBCCACBCCBACACACACABBCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABAACACBCBCCAAACCBCCABCCAABABBAACAAACBCBBACBBABCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBBBCCCBBBCBCBBBCBCCCBBCACCBCCACBCCBACACACACABBCAAC.exe" start= auto displayName= "UserDataSvc_BABAACACBCBCCAAACCBCCABCCAABABBAACAAACBCBBACBBABCCB"
  2⤵
  PID:12296
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABAACACBCBCCAAACCBCCABCCAABABBAACAAACBCBBACBBABCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBBBCCCBBBCBCBBBCBCCCBBCACCBCCACBCCBACACACACABBCAAC.exe" start= auto displayName= "UserDataSvc_BABAACACBCBCCAAACCBCCABCCAABABBAACAAACBCBBACBBABCCB"
    3⤵
    PID:8164

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBCCCABBCACCBCABCCBBBABBCCABACCCBCAACABCACCACCCCCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBCCCABBCACCBCABCCBBBABBCCABACCCBCAACABCACCACCCCCCBA.exe
1⤵
PID:1176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCACABABACBACBAAACBBCACACCACBCCACBBCCCAACBBABAABCCBAACACBAACBBBABBBBCCCCBCBBBAAACACABCABAABAABBBBBACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCAABBBCCCABCBCACCBACBAAACBAACACCAAAABBCBCAABABBCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCACABABACBACBAAACBBCACACCACBCCACBBCCCAACBBABAABCCBAACACBAACBBBABBBBCCCCBCBBBAAACACABCABAABAABBBBBACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCAABBBCCCABCBCACCBACBAAACBAACACCAAAABBCBCAABABBCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:10832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAACABCAACCBACACAACABCABBABCBACABABBBBAABCCBCCCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCAABBBCCCABCBCACCBACBAAACBAACACCAAAABBCBCAABABBCCCB.exe" start= auto displayName= "UserDataSvc_BBAACABCAACCBACACAACABCABBABCBACABABBBBAABCCBCCCBCB"
  2⤵
  PID:12780
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAACABCAACCBACACAACABCABBABCBACABABBBBAABCCBCCCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCAABBBCCCABCBCACCBACBAAACBAACACCAAAABBCBCAABABBCCCB.exe" start= auto displayName= "UserDataSvc_BBAACABCAACCBACACAACABCABBABCBACABABBBBAABCCBCCCBCB"
    3⤵
    PID:12916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAACABCAACCBACACAACABCABBABCBACABABBBBAABCCBCCCBCB"
  2⤵
  PID:8056
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAACABCAACCBACACAACABCABBABCBACABABBBBAABCCBCCCBCB"
    3⤵
    PID:8324

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBCCCABBCACCBCABCCBBBABBCCABACCCBCAACABCACCACCCCCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBCCCABBCACCBCABCCBBBABBCCABACCCBCAACABCACCACCCCCCBA.exe
1⤵
PID:7572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCACABABACBACBAAACBBCACACCACBCCACBBCCCAACBBABAABCCBAACACBAACBBBABBBBCCCCBCBBBAAACACABCABAABAABBBBBACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACABCACAACABABABCBBBAABBBABAAABCABCAAAACBBACBACABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCACABABACBACBAAACBBCACACCACBCCACBBCCCAACBBABAABCCBAACACBAACBBBABBBBCCCCBCBBBAAACACABCABAABAABBBBBACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACABCACAACABABABCBBBAABBBABAAABCABCAAAACBBACBACABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:11076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBAACAAABCBCCBBBBABBCACCBCBCCCACCCAABAAAABABACBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACABCACAACABABABCBBBAABBBABAAABCABCAAAACBBACBACABCAA.exe" start= auto displayName= "UserDataSvc_BACBAACAAABCBCCBBBBABBCACCBCBCCCACCCAABAAAABABACBBC"
  2⤵
  PID:13236
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBAACAAABCBCCBBBBABBCACCBCBCCCACCCAABAAAABABACBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACABCACAACABABABCBBBAABBBABAAABCABCAAAACBBACBACABCAA.exe" start= auto displayName= "UserDataSvc_BACBAACAAABCBCCBBBBABBCACCBCBCCCACCCAABAAAABABACBBC"
    3⤵
    - Launches sc.exe
    PID:11476

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAAACCCBCACCAACACABBCAAACBAAABAABCBCBBABBCCCBCBACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAAACCCBCACCAACACABBCAAACBAAABAABCBCBBABBCCCBCBACABA.exe
1⤵
PID:8528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCACCABAAAABACCABCBCACCBBACABACCBCACACBCAABBBBABCBBBACBAABCACBBCCBBACABCABCBCBCBBACABBCBAACABAACBBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBAABACCBCBCACBABBABCABAAABCBBABACBBAAABBCBBCAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:12752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCACCABAAAABACCABCBCACCBBACABACCBCACACBCAABBBBABCBBBACBAABCACBBCCBBACABCABCBCBCBBACABBCBAACABAACBBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBAABACCBCBCACBABBABCABAAABCBBABACBBAAABBCBBCAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBACCCCACBACBBCCCCACBBACABCAAABCBCAACABACBCCCBCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBAABACCBCBCACBABBABCABAAABCBBABACBBAAABBCBBCAAABB.exe" start= auto displayName= "UserDataSvc_CCBACCCCACBACBBCCCCACBBACABCAAABCBCAACABACBCCCBCCAA"
  2⤵
  PID:12320
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBACCCCACBACBBCCCCACBBACABCAAABCBCAACABACBCCCBCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBAABACCBCBCACBABBABCABAAABCBBABACBBAAABBCBBCAAABB.exe" start= auto displayName= "UserDataSvc_CCBACCCCACBACBBCCCCACBBACABCAAABCBCAACABACBCCCBCCAA"
    3⤵
    PID:7328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBACCCCACBACBBCCCCACBBACABCAAABCBCAACABACBCCCBCCAA"
  2⤵
  PID:14200

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAAACCCBCACCAACACABBCAAACBAAABAABCBCBBABBCCCBCBACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAAACCCBCACCAACACABBCAAACBAAABAABCBCBBABBCCCBCBACABA.exe
1⤵
PID:8600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABCBCCBCACCCCBABABAAAABBCBAAACACBCBCBCCCBACCBBACAABACCACCBCCBCBACBACBBACABCCBBAAAACCACBABACCABCABCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBBACABBAABACABCCBBABCABAABCABACBBBBAACCBACACCCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABCBCCBCACCCCBABABAAAABBCBAAACACBCBCBCCCBACCBBACAABACCACCBCCBCBACBACBBACABCCBBAAAACCACBABACCABCABCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBBACABBAABACABCCBBABCABAABCABACBBBBAACCBACACCCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:12164

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCACBBAABACACABABBABABBCBACCCBBCBCBBBCBCACACAAAAABCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCACBBAABACACABABBABABBCBACCCBBCBCBBBCBCACACAAAAABCAC.exe
1⤵
PID:8936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCBBBACBCBBBCBACBCBCBABAAAABAAAACBBBABBBCBBABCABBACCABBCBCCBACBCAAAACBBAAABBACBCAABAACCCCACAAABBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABACBACBBCBAABBCBABCBBCACBCBCCBBCACACACCCBAAACCACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCBBBACBCBBBCBACBCBCBABAAAABAAAACBBBABBBCBBABCABBACCABBCBCCBACBCAAAACBBAAABBACBCAABAACCCCACAAABBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABACBACBBCBAABBCBABCBBCACBCBCCBBCACACACCCBAAACCACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6692

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCBCABABCAAABACBCABABACCABABCACACBACCBACABAABBABCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCBCABABCAAABACBCABABACCABABCACACBACCBACABAABBABCBC.exe
1⤵
PID:8984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBAAAAABCCACAACCACACABABBBCACBCABACCBCCBBAAAACAAABCCCACAABCBCBCBCABABACCCABBBBACBBCCACCCCACABBCABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCCCBBABBABAACBBCAABACBBACACACACCBACCCBBABBBAABCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBAAAAABCCACAACCACACABABBBCACBCABACCBCCBBAAAACAAABCCCACAABCBCBCBCABABACCCABBBBACBBCCACCCCACABBCABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCCCBBABBABAACBBCAABACBBACACACACCBACCCBBABBBAABCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8948

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCBCABABCAAABACBCABABACCABABCACACBACCBACABAABBABCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCBCABABCAAABACBCABABACCABABCACACBACCBACABAABBABCBC.exe
1⤵
PID:8992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABCCABCCBBABBCCCBCCBABAABCCBACCBBACBBCAAABBAACCBCAAAAABABBCCABACBCCCCABBBBCCCCBBBABBBABCCCACBBBCBBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACBBACBBBCCAAABABCCABACCCABABACACAABCCAABCBBBCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:12696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABCCABCCBBABBCCCBCCBABAABCCBACCBBACBBCAAABBAACCBCAAAAABABBCCABACBCCCCABBBBCCCCBBBABBBABCCCACBBBCBBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACBBACBBBCCAAABABCCABACCCABABACACAABCCAABCBBBCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:9032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCABABBACCCCCBBBBABAABCAAACABBAAABBBCBCCBACAACCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACBBACBBBCCAAABABCCABACCCABABACACAABCCAABCBBBCACBC.exe" start= auto displayName= "UserDataSvc_CCCABABBACCCCCBBBBABAABCAAACABBAAABBBCBCCBACAACCAAB"
  2⤵
  PID:13652

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBACCBCCACCACAAAABBBBCBAABAAABBCCAAAAABAAABCBCABBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBACCBCCACCACAAAABBBBCBAABAAABBCCAAAAABAAABCBCABBBAB.exe
1⤵
PID:2628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAACCABBAABCCACCCCAAAABBACAACBCCABCBCCABCCABABBAABABBACABBBBABBBACAAACCACBCCBACCAABBBACBABCBCBBAACCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAAACBAABBACBBACBCCABCAABBABAABACBABBACBCAACABABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAACCABBAABCCACCCCAAAABBACAACBCCABCBCCABCCABABBAABABBACABBBBABBBACAAACCACBCCBACCAABBBACBABCBCBBAACCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAAACBAABBACBBACBCCABCAABBABAABACBABBACBCAACABABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCCACBBCCABABAACBCBCCABACCABCCABACCBACBBBBCBCCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAAACBAABBACBBACBCCABCAABBABAABACBABBACBCAACABABCBA.exe" start= auto displayName= "UserDataSvc_AACCCACBBCCABABAACBCBCCABACCABCCABACCBACBBBBCBCCAAB"
  2⤵
  PID:10096
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACCCACBBCCABABAACBCBCCABACCABCCABACCBACBBBBCBCCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAAACBAABBACBBACBCCABCAABBABAABACBABBACBCAACABABCBA.exe" start= auto displayName= "UserDataSvc_AACCCACBBCCABABAACBCBCCABACCABCCABACCBACBBBBCBCCAAB"
    3⤵
    - Launches sc.exe
    PID:5080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCCACBBCCABABAACBCBCCABACCABCCABACCBACBBBBCBCCAAB"
  2⤵
  PID:10380
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACCCACBBCCABABAACBCBCCABACCABCCABACCBACBBBBCBCCAAB"
    3⤵
    PID:10564

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACBABABABBCBCBABBBBCCCCACCABACBCBBBCBCBBBBABCACBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACBABABABBCBCBABBBBCCCCACCABACBCBBBCBCBBBBABCACBACA.exe
1⤵
PID:8432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABCBAAABBABACABBCBACCACACCCACAABCACBACCCCABCABCAACABCBCBABBBBCBABBAACBAACABCABAAABBABCABCAABBBABCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABABABBBCCACACAABABAACCACBABABCBBABCBBCCCCABAABBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABCBAAABBABACABBCBACCACACCCACAABCACBACCCCABCABCAACABCBCBABBBBCBABBAACBAACABCABAAABBABCABCAABBBABCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABABABBBCCACACAABABAACCACBABABCBBABCBBCCCCABAABBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:6016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCABAAABCBCAABAABBCBCABABCACCCABCBCAABCACCABBCABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABABABBBCCACACAABABAACCACBABABCBBABCBBCCCCABAABBAAC.exe" start= auto displayName= "UserDataSvc_CBCABAAABCBCAABAABBCBCABABCACCCABCBCAABCACCABBCABAA"
  2⤵
  PID:10632
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCABAAABCBCAABAABBCBCABABCACCCABCBCAABCACCABBCABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABABABBBCCACACAABABAACCACBABABCBBABCBBCCCCABAABBAAC.exe" start= auto displayName= "UserDataSvc_CBCABAAABCBCAABAABBCBCABABCACCCABCBCAABCACCABBCABAA"
    3⤵
    - Launches sc.exe
    PID:3464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCABAAABCBCAABAABBCBCABABCACCCABCBCAABCACCABBCABAA"
  2⤵
  PID:12256
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCABAAABCBCAABAABBCBCABABCACCCABCBCAABCACCABBCABAA"
    3⤵
    - Launches sc.exe
    PID:12460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACBABABABBCBCBABBBBCCCCACCABACBCBBBCBCBBBBABCACBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACBABABABBCBCBABBBBCCCCACCABACBCBBBCBCBBBBABCACBACA.exe
1⤵
PID:8724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCACAACBAACBACBCCAABCCCACBAABACCCCCACACCCCABBBBCBCAACABACCACABCAABAAAACACCAABBAABBBACCBBBABACCBBCAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACAAAAAACBAAABCCBCACCACCBACBCABCBBBABABCACCAABCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4932
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCACAACBAACBACBCCAABCCCACBAABACCCCCACACCCCABBBBCBCAACABACCACABCAABAAAACACCAABBAABBBACCBBBABACCBBCAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACAAAAAACBAAABCCBCACCACCBACBCABCBBBABABCACCAABCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:1996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACCBBCABCAAACBCCAACBBBACACABAABACACCABAABBCBBCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACAAAAAACBAAABCCBCACCACCBACBCABCBBBABABCACCAABCABA.exe" start= auto displayName= "UserDataSvc_ABACCBBCABCAAACBCCAACBBBACACABAABACACCABAABBCBBCABC"
  2⤵
  PID:10536
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACCBBCABCAAACBCCAACBBBACACABAABACACCABAABBCBBCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACAAAAAACBAAABCCBCACCACCBACBCABCBBBABABCACCAABCABA.exe" start= auto displayName= "UserDataSvc_ABACCBBCABCAAACBCCAACBBBACACABAABACACCABAABBCBBCABC"
    3⤵
    - Launches sc.exe
    PID:10408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACCBBCABCAAACBCCAACBBBACACABAABACACCABAABBCBBCABC"
  2⤵
  PID:12268
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACCBBCABCAAACBCCAACBBBACACABAABACACCABAABBCBBCABC"
    3⤵
    - Launches sc.exe
    PID:5392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBACCBCCACCACAAAABBBBCBAABAAABBCCAAAAABAAABCBCABBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBACCBCCACCACAAAABBBBCBAABAAABBCCAAAAABAAABCBCABBBAB.exe
1⤵
PID:9028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABACCCABABBACBACBCBAAABBBCCCBCACCACAAAAABBCBBCCABBABABBBBCACCBBBCCCBAAAACBCCCCABCCBAACBACBABCABBABCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABCCBACAACBCCAABCBBACCABBBAACABAAAABBBBBBCBBACAAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABACCCABABBACBACBCBAAABBBCCCBCACCACAAAAABBCBBCCABBABABBBBCACCBBBCCCBAAAACBCCCCABCCBAACBACBABCABBABCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABCCBACAACBCCAABCBBACCABBBAACABAAAABBBBBBCBBACAAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBACCCBCBCCAABCBABCABABABABBBBBBBBCCCAAABACABBCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABCCBACAACBCCAABCBBACCABBBAACABAAAABBBBBBCBBACAAABBC.exe" start= auto displayName= "UserDataSvc_CBBACCCBCBCCAABCBABCABABABABBBBBBBBCCCAAABACABBCBCB"
  2⤵
  PID:9844
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBACCCBCBCCAABCBABCABABABABBBBBBBBCCCAAABACABBCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABCCBACAACBCCAABCBBACCABBBAACABAAAABBBBBBCBBACAAABBC.exe" start= auto displayName= "UserDataSvc_CBBACCCBCBCCAABCBABCABABABABBBBBBBBCCCAAABACABBCBCB"
    3⤵
    - Launches sc.exe
    PID:12048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBACCCBCBCCAABCBABCABABABABBBBBBBBCCCAAABACABBCBCB"
  2⤵
  PID:10356
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBACCCBCBCCAABCBABCABABABABBBBBBBBCCCAAABACABBCBCB"
    3⤵
    PID:10404

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCBCBABBAABCBCACBCCCCBCACBBBCCACBCCACBBACCBAABBABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCBCBABBAABCBCACBCCCCBCACBBBCCACBCCACBBACCBAABBABCB.exe
1⤵
PID:8244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCCACCBACACABCCACBBCACCACABAAABCCAABCCCCACBABAACBCAACAAAABABCABBABBCABCAAABCBAAACAABBCBCCBBCBAABBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBACCACABBBABACCCABBBCAACBBBBBBAACBBBACACBCCACAACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3572
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCCACCBACACABCCACBBCACCACABAAABCCAABCCCCACBABAACBCAACAAAABABCABBABBCABCAAABCBAAACAABBCBCCBBCBAABBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBACCACABBBABACCCABBBCAACBBBBBBAACBBBACACBCCACAACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:11772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACAAACABCCBACCACCAACCBCBBABACBCCBBCBCCACCCAACBACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBACCACABBBABACCCABBBCAACBBBBBBAACBBBACACBCCACAACBCC.exe" start= auto displayName= "UserDataSvc_CACAAACABCCBACCACCAACCBCBBABACBCCBBCBCCACCCAACBACBA"
  2⤵
  PID:3856
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACAAACABCCBACCACCAACCBCBBABACBCCBBCBCCACCCAACBACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBACCACABBBABACCCABBBCAACBBBBBBAACBBBACACBCCACAACBCC.exe" start= auto displayName= "UserDataSvc_CACAAACABCCBACCACCAACCBCBBABACBCCBBCBCCACCCAACBACBA"
    3⤵
    PID:12616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACAAACABCCBACCACCAACCBCBBABACBCCBBCBCCACCCAACBACBA"
  2⤵
  PID:7940
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACAAACABCCBACCACCAACCBCBBABACBCCBBCBCCACCCAACBACBA"
    3⤵
    - Launches sc.exe
    PID:8940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBBCBABCAACCCCABACBBBCAABCAAABCABABAACACAABBBCAACBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBBCBABCAACCCCABACBBBCAABCAAABCABABAACACAABBBCAACBBA.exe
1⤵
PID:4188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABBCACAACBBBABAACCCBABCABBBCBACCACACBBAAACCBCABCACCCBABBABABBAAAACCACAACCCABACCBCCACBBCBCCABCABCCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCACCCBCCCACBCAABACBAAABAACCBABBAABABAACCABBCAABBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABBCACAACBBBABAACCCBABCABBBCBACCACACBBAAACCBCABCACCCBABBABABBAAAACCACAACCCABACCBCCACBBCBCCABCABCCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCACCCBCCCACBCAABACBAAABAACCBABBAABABAACCABBCAABBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAACACBACBAACCBABACBCAACBBBACCACCCBCCAABAABCBBACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCACCCBCCCACBCAABACBAAABAACCBABBAABABAACCABBCAABBCA.exe" start= auto displayName= "UserDataSvc_CBAACACBACBAACCBABACBCAACBBBACCACCCBCCAABAABCBBACCA"
  2⤵
  PID:11508
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAACACBACBAACCBABACBCAACBBBACCACCCBCCAABAABCBBACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCACCCBCCCACBCAABACBAAABAACCBABBAABABAACCABBCAABBCA.exe" start= auto displayName= "UserDataSvc_CBAACACBACBAACCBABACBCAACBBBACCACCCBCCAABAABCBBACCA"
    3⤵
    - Launches sc.exe
    PID:13068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAACACBACBAACCBABACBCAACBBBACCACCCBCCAABAABCBBACCA"
  2⤵
  PID:13140
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAACACBACBAACCBABACBCAACBBBACCACCCBCCAABAABCBBACCA"
    3⤵
    PID:12924

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCABBBBAAACABAACBCABCCACAABCCBBACBACAAAABCBCBCBBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCABBBBAAACABAACBCABCCACAABCCBBACBACAAAABCBCBCBBCBC.exe
1⤵
PID:3928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACAAABACCAACBCABBCBBBCABCCBAABACBAACAAABAACCABABACBBBAABACACCBBACBABBCBCCCCAACBCABBCCBBCCBCBCBBBACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCABAABBCBBCCCACBCBBACBABAABBCABABABAABACCBBCBBCAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACAAABACCAACBCABBCBBBCABCCBAABACBAACAAABAACCABABACBBBAABACACCBBACBABBCBCCCCAACBCABBCCBBCCBCBCBBBACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCABAABBCBBCCCACBCBBACBABAABBCABABABAABACCBBCBBCAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:3296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCABCCBBBCCBCCBBAABACCBBBBABCCBBBABAAABBCCABBCCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCABAABBCBBCCCACBCBBACBABAABBCABABABAABACCBBCBBCAACA.exe" start= auto displayName= "UserDataSvc_ACCABCCBBBCCBCCBBAABACCBBBBABCCBBBABAAABBCCABBCCBBC"
  2⤵
  PID:9840
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCABCCBBBCCBCCBBAABACCBBBBABCCBBBABAAABBCCABBCCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCABAABBCBBCCCACBCBBACBABAABBCABABABAABACCBBCBBCAACA.exe" start= auto displayName= "UserDataSvc_ACCABCCBBBCCBCCBBAABACCBBBBABCCBBBABAAABBCCABBCCBBC"
    3⤵
    - Launches sc.exe
    PID:12800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCABCCBBBCCBCCBBAABACCBBBBABCCBBBABAAABBCCABBCCBBC"
  2⤵
  PID:1756
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCABCCBBBCCBCCBBAABACCBBBBABCCBBBABAAABBCCABBCCBBC"
    3⤵
    - Launches sc.exe
    PID:7448

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABCACBCBACAACAACABCAAAACBBABCBBACBAACBCAABACACCBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABCACBCBACAACAACABCAAAACBBABCBBACBAACBCAABACACCBBAC.exe
1⤵
PID:8232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAAABAAACACABCBCBABBBBACABCAACCBBAABBCABBCCABAABABBBBBCBBBABBCABCAAABBACCCBBBABBACBAACACBCBBCCCCABAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBABBAABBCCAAACCCCBAABCBCBCBBBBCCBAAACBCBCAAAACACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAAABAAACACABCBCBABBBBACABCAACCBBAABBCABBCCABAABABBBBBCBBBABBCABCAAABBACCCBBBABBACBAACACBCBBCCCCABAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBABBAABBCCAAACCCCBAABCBCBCBBBBCCBAAACBCBCAAAACACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCBCBCABBABACBABACCBBCCACBCCBBBABBBBCACCCBBBBBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBABBAABBCCAAACCCCBAABCBCBCBBBBCCBAAACBCBCAAAACACBC.exe" start= auto displayName= "UserDataSvc_BBBCBCBCABBABACBABACCBBCCACBCCBBBABBBBCACCCBBBBBCAB"
  2⤵
  PID:11776
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCBCBCABBABACBABACCBBCCACBCCBBBABBBBCACCCBBBBBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBABBAABBCCAAACCCCBAABCBCBCBBBBCCBAAACBCBCAAAACACBC.exe" start= auto displayName= "UserDataSvc_BBBCBCBCABBABACBABACCBBCCACBCCBBBABBBBCACCCBBBBBCAB"
    3⤵
    - Launches sc.exe
    PID:12992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCBCBCABBABACBABACCBBCCACBCCBBBABBBBCACCCBBBBBCAB"
  2⤵
  PID:11892
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCBCBCABBABACBABACCBBCCACBCCBBBABBBBCACCCBBBBBCAB"
    3⤵
    - Launches sc.exe
    PID:10352

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABCACBCBACAACAACABCAAAACBBABCBBACBAACBCAABACACCBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAABCACBCBACAACAACABCAAAACBBABCBBACBAACBCAABACACCBBAC.exe
1⤵
PID:8352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBACCCCCAAABBBCBBCCABACABAACACCAACCBBAACAACCABBAAABACBBCBCACBBBCACCAABBCACCCBCABABBBBAACBAABCCBBCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBBCAAABACAABCCABBBBBCABAAACBBAACCCBCBACAACAABBAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBACCCCCAAABBBCBBCCABACABAACACCAACCBBAACAACCABBAAABACBBCBCACBBBCACCAABBCACCCBCABABBBBAACBAABCCBBCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBBCAAABACAABCCABBBBBCABAAACBBAACCCBCBACAACAABBAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:10372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACACCAABCCAACABCCBBACBBABABCCBCCCBABACABACCACBCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBBCAAABACAABCCABBBBBCABAAACBBAACCCBCBACAACAABBAABA.exe" start= auto displayName= "UserDataSvc_CACACCAABCCAACABCCBBACBBABABCCBCCCBABACABACCACBCCCA"
  2⤵
  PID:4252
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACACCAABCCAACABCCBBACBBABABCCBCCCBABACABACCACBCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBBCAAABACAABCCABBBBBCABAAACBBAACCCBCBACAACAABBAABA.exe" start= auto displayName= "UserDataSvc_CACACCAABCCAACABCCBBACBBABABCCBCCCBABACABACCACBCCCA"
    3⤵
    PID:6500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACACCAABCCAACABCCBBACBBABABCCBCCCBABACABACCACBCCCA"
  2⤵
  PID:13184
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACACCAABCCAACABCCBBACBBABABCCBCCCBABACABACCACBCCCA"
    3⤵
    - Launches sc.exe
    PID:10856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCBCBABBAABCBCACBCCCCBCACBBBCCACBCCACBBACCBAABBABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCBCBABBAABCBCACBCCCCBCACBBBCCACBCCACBBACCBAABBABCB.exe
1⤵
PID:8580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBAABCBAACCBABCBBABCCABACABBABCCACCABCCCCACBBBCBCABCCBAACAAACBBBBACBAAACABCCBCAABCBAABCBCBBABAACAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCACCABBABBBABAAAACACBAACCCCCCAACACACBCCCBCBABBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBAABCBAACCBABCBBABCCABACABBABCCACCABCCCCACBBBCBCABCCBAACAAACBBBBACBAAACABCCBCAABCBAABCBCBBABAACAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCACCABBABBBABAAAACACBAACCCCCCAACACACBCCCBCBABBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBACCBCBBBBABBCCCCCBBABAACABBABBBABABBAAAABABCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCACCABBABBBABAAAACACBAACCCCCCAACACACBCCCBCBABBAAA.exe" start= auto displayName= "UserDataSvc_BCBBACCBCBBBBABBCCCCCBBABAACABBABBBABABBAAAABABCBCB"
  2⤵
  PID:11708
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBACCBCBBBBABBCCCCCBBABAACABBABBBABABBAAAABABCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCACCABBABBBABAAAACACBAACCCCCCAACACACBCCCBCBABBAAA.exe" start= auto displayName= "UserDataSvc_BCBBACCBCBBBBABBCCCCCBBABAACABBABBBABABBAAAABABCBCB"
    3⤵
    - Launches sc.exe
    PID:11108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBACCBCBBBBABBCCCCCBBABAACABBABBBABABBAAAABABCBCB"
  2⤵
  PID:1724
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBACCBCBBBBABBCCCCCBBABAACABBABBBABABBAAAABABCBCB"
    3⤵
    PID:4804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBBCBABCAACCCCABACBBBCAABCAAABCABABAACACAABBBCAACBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBBCBABCAACCCCABACBBBCAABCAAABCABABAACACAABBBCAACBBA.exe
1⤵
PID:8540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBABBCCABBCAAABBCBABCABCAACBBAABCABCBBABBACBABBABCBCACABACBBAACBBCBBACACCCBACACCAABAABBBAAABAAABAAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCAAAAABBACACCABCBBABABCBCACAAAABBACBBACBCACBCABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBABBCCABBCAAABBCBABCABCAACBBAABCABCBBABBACBABBABCBCACABACBBAACBBCBBACACCCBACACCAABAABBBAAABAAABAAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCAAAAABBACACCABCBBABABCBCACAAAABBACBBACBCACBCABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBACBABCBBACACCABACCBACCCACAABCBCCAACCBACCCCCACACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCAAAAABBACACCABCBBABABCBCACAAAABBACBBACBCACBCABBB.exe" start= auto displayName= "UserDataSvc_ACBACBABCBBACACCABACCBACCCACAABCBCCAACCBACCCCCACACB"
  2⤵
  PID:10340
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBACBABCBBACACCABACCBACCCACAABCBCCAACCBACCCCCACACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCAAAAABBACACCABCBBABABCBCACAAAABBACBBACBCACBCABBB.exe" start= auto displayName= "UserDataSvc_ACBACBABCBBACACCABACCBACCCACAABCBCCAACCBACCCCCACACB"
    3⤵
    - Launches sc.exe
    PID:12912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBACBABCBBACACCABACCBACCCACAABCBCCAACCBACCCCCACACB"
  2⤵
  PID:12456
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBACBABCBBACACCABACCBACCCACAABCBCCAACCBACCCCCACACB"
    3⤵
    PID:12700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCABBBBAAACABAACBCABCCACAABCCBBACBACAAAABCBCBCBBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCABBBBAAACABAACBCABCCACAABCCBBACBACAAAABCBCBCBBCBC.exe
1⤵
PID:8620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABBCAABACCABACACABAACAACCBACCAABBBCCCAACCABBBBABCCBCAABBBCCBAAAABBBCBAACACBCBCBCCAAAAABACBCCCACCABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCBCABBAAABCBCBCBCCCAABBCCCBAABABBAAACBAACABBBAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABBCAABACCABACACABAACAACCBACCAABBBCCCAACCABBBBABCCBCAABBBCCBAAAABBBCBAACACBCBCBCCAAAAABACBCCCACCABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCBCABBAAABCBCBCBCCCAABBCCCBAABABBAAACBAACABBBAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBCBACCAABABCCABCBACACCACABCBCAABAACBABACABBBCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCBCABBAAABCBCBCBCCCAABBCCCBAABABBAAACBAACABBBAABAC.exe" start= auto displayName= "UserDataSvc_CABBCBACCAABABCCABCBACACCACABCBCAABAACBABACABBBCCBA"
  2⤵
  PID:6164
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABBCBACCAABABCCABCBACACCACABCBCAABAACBABACABBBCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCBCABBAAABCBCBCBCCCAABBCCCBAABABBAAACBAACABBBAABAC.exe" start= auto displayName= "UserDataSvc_CABBCBACCAABABCCABCBACACCACABCBCAABAACBABACABBBCCBA"
    3⤵
    PID:13308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBCBACCAABABCCABCBACACCACABCBCAABAACBABACABBBCCBA"
  2⤵
  PID:12796
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABBCBACCAABABCCABCBACACCACABCBCAABAACBABACABBBCCBA"
    3⤵
    PID:10344

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBAACBBBCCAAAACBBCBCCBCCBBCABABAACCBACCBBABBAAAAACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBAACBBBCCAAAACBBCBCCBCCBBCABABAACCBACCBBABBAAAAACCBA.exe
1⤵
PID:9636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBAACAABAACBCBAABABCBAACCAAAABACCCACABCAACCCAACAAACCBCABACAAAABCBABCACAACBCACCCCBAACACBBCBAAAAABBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAABBBAACCCACAABCBAABCCABAACCBBAACCBCCBABABBACCCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:12264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBAACAABAACBCBAABABCBAACCAAAABACCCACABCAACCCAACAAACCBCABACAAAABCBABCACAACBCACCCCBAACACBBCBAAAAABBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAABBBAACCCACAABCBAABCCABAACCBBAACCBCCBABABBACCCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:12452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBBAABCCCCABBBAACAABCACBABCABBAACACBBCCAAABBAAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAABBBAACCCACAABCBAABCCABAACCBBAACCBCCBABABBACCCACBC.exe" start= auto displayName= "UserDataSvc_ABBBBAABCCCCABBBAACAABCACBABCABBAACACBBCCAAABBAAAAC"
  2⤵
  PID:10884
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBBBAABCCCCABBBAACAABCACBABCABBAACACBBCCAAABBAAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAABBBAACCCACAABCBAABCCABAACCBBAACCBCCBABABBACCCACBC.exe" start= auto displayName= "UserDataSvc_ABBBBAABCCCCABBBAACAABCACBABCABBAACACBBCCAAABBAAAAC"
    3⤵
    - Launches sc.exe
    PID:7240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBBAABCCCCABBBAACAABCACBABCABBAACACBBCCAAABBAAAAC"
  2⤵
  PID:10396
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBBBAABCCCCABBBAACAABCACBABCABBAACACBBCCAAABBAAAAC"
    3⤵
    - Launches sc.exe
    PID:12856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBAACBBBCCAAAACBBCBCCBCCBBCABABAACCBACCBBABBAAAAACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBAACBBBCCAAAACBBCBCCBCCBBCABABAACCBACCBBABBAAAAACCBA.exe
1⤵
PID:9644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABACCBCABBCAABBCCBBAACBAABBAABBAACCBBABACCBCABBABBCAABCACACCCBCAAACBCBBCBCBBCBABBAABCABCBAACCCBCABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBBCBCAABCBBCCBAABABBCBABBCBCBACCAACCACACCBBBACCACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABACCBCABBCAABBCCBBAACBAABBAABBAACCBBABACCBCABBABBCAABCACACCCBCAAACBCBBCBCBBCBABBAABCABCBAACCCBCABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBBCBCAABCBBCCBAABABBCBABBCBCBACCAACCACACCBBBACCACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:3812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCBCACBABCAAACBAAABABAABABCBABCBAAABCCACACACACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBBCBCAABCBBCCBAABABBCBABBCBCBACCAACCACACCBBBACCACAC.exe" start= auto displayName= "UserDataSvc_BBBCBCACBABCAAACBAAABABAABABCBABCBAAABCCACACACACBAA"
  2⤵
  PID:11880
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCBCACBABCAAACBAAABABAABABCBABCBAAABCCACACACACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBBCBCAABCBBCCBAABABBCBABBCBCBACCAACCACACCBBBACCACAC.exe" start= auto displayName= "UserDataSvc_BBBCBCACBABCAAACBAAABABAABABCBABCBAAABCCACACACACBAA"
    3⤵
    PID:12600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCBCACBABCAAACBAAABABAABABCBABCBAAABCCACACACACBAA"
  2⤵
  PID:6708
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCBCACBABCAAACBAAABABAABABCBABCBAAABCCACACACACBAA"
    3⤵
    - Launches sc.exe
    PID:11096

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCBBACCABBACBBBACAABAABBCAACCABCBABCBABBBBCBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCBBACCABBACBBBACAABAABBCAACCABCBABCBABBBBCBCCC.exe
1⤵
PID:9684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABACCBCABBCAABBCCBBAACBAABBAABBAACCBBABACCBCABBABBCAABCACACCCBCAAACBCBBCBCBBCBABBAABCABCBAACCCBCABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBACBBACCCCCBABCBBAABBBABCACABABCBBBBCCBBABCABAAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABACCBCABBCAABBCCBBAACBAABBAABBAACCBBABACCBCABBABBCAABCACACCCBCAAACBCBBCBCBBCBABBAABCABCBAACCCBCABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBACBBACCCCCBABCBBAABBBABCACABABCBBBBCCBBABCABAAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACABCACABBCACBBAACABCACCBBCCCACCCBABCCBCCAAABCABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBACBBACCCCCBABCBBAABBBABCACABABCBBBBCCBBABCABAAABBB.exe" start= auto displayName= "UserDataSvc_CACABCACABBCACBBAACABCACCBBCCCACCCBABCCBCCAAABCABCB"
  2⤵
  PID:7640
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACABCACABBCACBBAACABCACCBBCCCACCCBABCCBCCAAABCABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBACBBACCCCCBABCBBAABBBABCACABABCBBBBCCBBABCABAAABBB.exe" start= auto displayName= "UserDataSvc_CACABCACABBCACBBAACABCACCBBCCCACCCBABCCBCCAAABCABCB"
    3⤵
    PID:8488

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCBBACCABBACBBBACAABAABBCAACCABCBABCBABBBBCBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCBBACCABBACBBBACAABAABBCAACCABCBABCBABBBBCBCCC.exe
1⤵
PID:9776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCBAACCBBBBCABCCAACCBBCCCAACABACAACBCACCCCCCBBABCBABBCCCAACBABBCABBBBBBAABCBABAABCBCAACCCBCACBACACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCABABABAACACAACBCBABACBCAABCABBBAACABCCBAABCBACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCBAACCBBBBCABCCAACCBBCCCAACABACAACBCACCCCCCBBABCBABBCCCAACBABBCABBBBBBAABCBABAABCBCAACCCBCACBACACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCABABABAACACAACBCBABACBCAABCABBBAACABCCBAABCBACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:12432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCCBACBABBAAAAABCCBBCAAABCAABBABBAABBBBCBCBBBAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCABABABAACACAACBCBABACBCAABCABBBAACABCCBAABCBACAAC.exe" start= auto displayName= "UserDataSvc_CACCCBACBABBAAAAABCCBBCAAABCAABBABBAABBBBCBCBBBAAAB"
  2⤵
  PID:10680
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACCCBACBABBAAAAABCCBBCAAABCAABBABBAABBBBCBCBBBAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCABABABAACACAACBCBABACBCAABCABBBAACABCCBAABCBACAAC.exe" start= auto displayName= "UserDataSvc_CACCCBACBABBAAAAABCCBBCAAABCAABBABBAABBBBCBCBBBAAAB"
    3⤵
    PID:6020

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAABBBCBCCAABCBCBBBACABCBCACACABCBBBCBCAAAACAAAABACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAABBBCBCCAABCBCBBBACABCBCACACABCBBBCBCAAAACAAAABACB.exe
1⤵
PID:9980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCAACCBABBAACBACBCBCBAACCCCAABCACAAACBCBCBCCCCBCCBCBBABBCAABBABAABCCBABAABABBBBBBBCCABACAAAACBCCCCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABAACAAACAABABCCABAAABCCAABCABCCAABAACABACACBBBBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCAACCBABBAACBACBCBCBAACCCCAABCACAAACBCBCBCCCCBCCBCBBABBCAABBABAABCCBABAABABBBBBBBCCABACAAAACBCCCCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABAACAAACAABABCCABAAABCCAABCABCCAABAACABACACBBBBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBCAAAACACCBACBCBBAABBBBCCCCCBBBAACCABAABBABBACBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABAACAAACAABABCCABAAABCCAABCABCCAABAACABACACBBBBCCB.exe" start= auto displayName= "UserDataSvc_ABBCAAAACACCBACBCBBAABBBBCCCCCBBBAACCABAABBABBACBBB"
  2⤵
  PID:9504
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBCAAAACACCBACBCBBAABBBBCCCCCBBBAACCABAABBABBACBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABAACAAACAABABCCABAAABCCAABCABCCAABAACABACACBBBBCCB.exe" start= auto displayName= "UserDataSvc_ABBCAAAACACCBACBCBBAABBBBCCCCCBBBAACCABAABBABBACBBB"
    3⤵
    - Launches sc.exe
    PID:7916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBCAAAACACCBACBCBBAABBBBCCCCCBBBAACCABAABBABBACBBB"
  2⤵
  PID:8736

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACAABBACBCACCAACCBABAAACAABCBBBCAAABCACBCBBACCBCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACAABBACBCACCAACCBABAAACAABCBBBCAAABCACBCBBACCBCCCA.exe
1⤵
PID:9404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBACACBBABAABCBCCCCACCBBBAAABBCBBABCAABCAAAABAABCAAAACCCAABCBCCAAAABBBACBCAACCCACCACBAAABBACBCBABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABCCABCCACCBCABBBCCBBABBCCACACBAACCCCBBAACABAACBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:12448
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBACACBBABAABCBCCCCACCBBBAAABBCBBABCAABCAAAABAABCAAAACCCAABCBCCAAAABBBACBCAACCCACCACBAAABBACBCBABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABCCABCCACCBCABBBCCBBABBCCACACBAACCCCBBAACABAACBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABABCAABBABABBBCBAAACAACBCABBABCBABBCBBAACCAABABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABCCABCCACCBCABBBCCBBABBCCACACBAACCCCBBAACABAACBACA.exe" start= auto displayName= "UserDataSvc_ABABCAABBABABBBCBAAACAACBCABBABCBABBCBBAACCAABABBBC"
  2⤵
  PID:8492

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABBABAACAAABABCABACAACCCABCCABCCBAABCBABCACCCACBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABBABAACAAABABCABACAACCCABCCABCCBAABCBABCACCCACBBA.exe
1⤵
PID:3544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAABCCCABCBACACBBBAACAACCCBBBABBBBABCAAACCCAABBCABCBAABAABBAACCBABACCCBABBCCBCAACABABBACBBACCBCAAAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACACCACABACABBAABBABBCBABABBBBBBACABCBCCCABCCCCBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8200

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAAACBAABBACBBACBCCABCAABBABAABACBABBACBCAACABABCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAAACBAABBACBBACBCCABCAABBABAABACBABBACBCAACABABCBA.exe
1⤵
PID:9592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACACCBCBCBBBBACABAABCCCCBABABCAABCCABBBCAABBACBBBCBBCACABABACACACCBACCCBAACCCBACCCACBACCCBCCBACBBBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCABABCCBABACBCAACACABACABCAACBCBCCACBABBABAACBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7980

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACAABBACBCACCAACCBABAAACAABCBBBCAAABCACBCBBACCBCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACAABBACBCACCAACCBABAAACAABCBBBCAAABCACBCBBACCBCCCA.exe
1⤵
PID:9896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCABCBBCAABBCBBCCAABCABCBCAABCBACBCBCCAABBAAACBACBBBBABBBAAACAAABCBAACBCACCBACABABABBABBCACAAABACBBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABCCCCBAACBACCACACACBCBBAACCBCCBBBCCCCAACAACBCCBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:13580

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABBABAACAAABABCABACAACCCABCCABCCBAABCBABCACCCACBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABBABAACAAABABCABACAACCCABCCABCCBAABCBABCACCCACBBA.exe
1⤵
PID:10256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBABCCCCBAACBACCACACACBCBBAACCBCCBBBCCCCAACAACBCCBAACBBBBBCCBABAACAAAACCAABCACCBCBAAABAACCBBCBCBACCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABACBAABCBBBAACAACBBBBAAAAABCBBBABCACAACABACAABBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:13356

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCCBBBCCBABCCAABABCBCBCCBAABAABAACACAABCCACCAABACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCCBBBCCBABCCAABABCBCBCCBAABAABAACACAABCCACCAABACBC.exe
1⤵
PID:10272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACCACAAABABACCABCBABCCABBBAAACABCBCCCCCABBCBBAABAACCCBCABACBBCBBACCCBBCACCCCCBBABABACACACCAAACCCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACABBBCBCCABACCCBCABCACBBCCABBACCBABCBACCCCACBBCACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:13536

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACAACBAACBACBCCAABCCCACBAABACCCCCACACCCCABBBBCBCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACAACBAACBACBCCAABCCCACBAABACCCCCACACCCCABBBBCBCAAC.exe
1⤵
PID:10580

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABABABBBCCACACAABABAACCACBABABCBBABCBBCCCCABAABBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABABABBBCCACACAABABAACCACBABABCBBABCBBCCCCABAABBAAC.exe
1⤵
PID:10840

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAAACBAABBACBBACBCCABCAABBABAABACBABBACBCAACABABCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAAACBAABBACBBACBCCABCAABBABAABACBABBACBCAACABABCBA.exe
1⤵
PID:4580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACACAACCCAABABCAAAAABCBBBBBCBBBCBCBCBAACBBCBCBACCCBABBABBACABBACBACABCAACABBACBBACCAAAAABCCBBCCCCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBCBCACBCCBBCBCACCCCCCBABAACCBCCCCBBABCCABCCABBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACACAACCCAABABCAAAAABCBBBBBCBBBCBCBCBAACBBCBCBACCCBABBABBACABBACBACABCAACABBACBBACCAAAAABCCBBCCCCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBCBCACBCCBBCBCACCCCCCBABAACCBCCCCBBABCCABCCABBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:13256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBCCCBBACBAAAAABBBBABBBCBCBABBCCCACAABCACBCCCBBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBCBCACBCCBBCBCACCCCCCBABAACCBCCCCBBABCCABCCABBCCC.exe" start= auto displayName= "UserDataSvc_ABBCCCBBACBAAAAABBBBABBBCBCBABBCCCACAABCACBCCCBBABA"
  2⤵
  PID:7856
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBCCCBBACBAAAAABBBBABBBCBCBABBCCCACAABCACBCCCBBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBCBCACBCCBBCBCACCCCCCBABAACCBCCCCBBABCCABCCABBCCC.exe" start= auto displayName= "UserDataSvc_ABBCCCBBACBAAAAABBBBABBBCBCBABBCCCACAABCACBCCCBBABA"
    3⤵
    - Launches sc.exe
    PID:8736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBCCCBBACBAAAAABBBBABBBCBCBABBCCCACAABCACBCCCBBABA"
  2⤵
  PID:13664

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCCBBBCCBABCCAABABCBCBCCBAABAABAACACAABCCACCAABACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCCBBBCCBABCCAABABCBCBCCBAABAABAACACAABCCACCAABACBC.exe
1⤵
PID:11960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBBAACACBBBAABAABCBAACBABCBAACCBBCCABBCAAACBBABBCBABABACBBBBBBABBAABABBBACCBCBBACBCBBBACBCBCCACBACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABAACAAACAABABCCABAAABCCAABCABCCAABAACABACACBBBBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBBAACACBBBAABAABCBAACBABCBAACCBBCCABBCAAACBBABBCBABABACBBBBBBABBAABABBBACCBCBBACBCBBBACBCBCCACBACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABAACAAACAABABCCABAAABCCAABCABCCAABAACABACACBBBBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCBCCBBCBCBCCCAABCACBAAABACCBABCBAABCAABBABBCBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABAACAAACAABABCCABAAABCCAABCABCCAABAACABACACBBBBCCB.exe" start= auto displayName= "UserDataSvc_CCCCBCCBBCBCBCCCAABCACBAAABACCBABCBAABCAABBABBCBBCA"
  2⤵
  PID:7524
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCBCCBBCBCBCCCAABCACBAAABACCBABCBAABCAABBABBCBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABAACAAACAABABCCABAAABCCAABCABCCAABAACABACACBBBBCCB.exe" start= auto displayName= "UserDataSvc_CCCCBCCBBCBCBCCCAABCACBAAABACCBABCBAABCAABBABBCBBCA"
    3⤵
    PID:12592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCBCCBBCBCBCCCAABCACBAAABACCBABCBAABCAABBABBCBBCA"
  2⤵
  PID:13752

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAAABAACAABCCCACAACBBBCCAACAACAACABCABCAABBCABACCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAAABAACAABCCCACAACBBBCCAACAACAACABCABCAABBCABACCCC.exe
1⤵
PID:12284

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCACCCBCCCACBCAABACBAAABAACCBABBAABABAACCABBCAABBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCACCCBCCCACBCAABACBAAABAACCBABBAABABAACCABBCAABBCA.exe
1⤵
PID:12136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACAAAAAACBAAABCCBCACCACCBACBCABCBBBABABCACCAABCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACAAAAAACBAAABCCBCACCACCBACBCABCBBBABABCACCAABCABA.exe
1⤵
PID:10228

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBABCCAACAABACBABABABBAABCBBBABAAAACBBBBBCBCACABBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBABCCAACAABACBABABABBAABCBBBABAAAACBBBBBCBCACABBCAC.exe
1⤵
PID:10752

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBABCCAACAABACBABABABBAABCBBBABAAAACBBBBBCBCACABBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBABCCAACAABACBABABABBAABCBBBABAAAACBBBBBCBCACABBCAC.exe
1⤵
PID:12128

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABCCBACAACBCCAABCBBACCABBBAACABAAAABBBBBBCBBACAAABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABCCBACAACBCCAABCBBACCABBBAACABAAAABBBBBBCBBACAAABBC.exe
1⤵
PID:9596

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCABAABBCBBCCCACBCBBACBABAABBCABABABAABACCBBCBBCAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCABAABBCBBCCCACBCBBACBABAABBCABABABAABACCBBCBBCAACA.exe
1⤵
PID:4380

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCCABBBAABACBCBBCBACACBCCBAABABCABABACAAACABCAABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCCABBBAABACBCBBCBACACBCCBAABABCABABACAAACABCAABAA.exe
1⤵
PID:3552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBBCAAABACAABCCABBBBBCABAAACBBAACCCBCBACAACAABBAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBBCAAABACAABCCABBBBBCABAAACBBAACCCBCBACAACAABBAABA.exe
1⤵
PID:896

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACAACBAACBACBCCAABCCCACBAABACCCCCACACCCCABBBBCBCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACAACBAACBACBCCAABCCCACBAABACCCCCACACCCCABBBBCBCAAC.exe
1⤵
PID:3708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBACCACABBBABACCCABBBCAACBBBBBBAACBBBACACBCCACAACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBACCACABBBABACCCABBBCAACBBBBBBAACBBBACACBCCACAACBCC.exe
1⤵
PID:2304

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACAAAAAACBAAABCCBCACCACCBACBCABCBBBABABCACCAABCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACAAAAAACBAAABCCBCACCACCBACBCABCBBBABABCACCAABCABA.exe
1⤵
PID:12580

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABABABBBCCACACAABABAACCACBABABCBBABCBBCCCCABAABBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABABABBBCCACACAABABAACCACBABABCBBABCBBCCCCABAABBAAC.exe
1⤵
PID:12844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCCAABCCBCAACABCCCABACCACBCACABACACACCCABACCBAACBCACCCAABCCBABCCBABABABCBABACCCCBABAACCCBACACBBBBBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCABBBAABBACCAABBBABCAABAABCCBCAACCACCAAABAAAACBBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCCAABCCBCAACABCCCABACCACBCACABACACACCCABACCBAACBCACCCAABCCBABCCBABABABCBABACCCCBABAACCCBACACBBBBBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCABBBAABBACCAABBBABCAABAABCCBCAACCACCAAABAAAACBBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:3464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBABBBBCAAACCAACCAAABACCCBCCCACBCCCCACCBAAACAABACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCABBBAABBACCAABBBABCAABAABCCBCAACCACCAAABAAAACBBBBC.exe" start= auto displayName= "UserDataSvc_ABBABBBBCAAACCAACCAAABACCCBCCCACBCCCCACCBAAACAABACB"
  2⤵
  PID:14212

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBAACCBBACBBBCCCABCCABBABCBBCCCBABABBAAACABCCBABCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBAACCBBACBBBCCCABCCABBABCBBCCCBABABBAAACABCCBABCBA.exe
1⤵
PID:12608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAABBBBBAABAACAAAAABAACCCAABCACABCABBAAABCCACACBACCCCCCABBACCAABCABBCAAACCBCABBBCBCCCBBAACCBBCABACBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCACCABAABACAACABBBBAACCBAAABCCACCBCCCACCCAACCBAAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:13036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAABBBBBAABAACAAAAABAACCCAABCACABCABBAAABCCACACBACCCCCCABBACCAABCABBCAAACCBCABBBCBCCCBBAACCBBCABACBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCACCABAABACAACABBBBAACCBAAABCCACCBCCCACCCAACCBAAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:14084

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABCCBACAACBCCAABCBBACCABBBAACABAAAABBBBBBCBBACAAABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABCCBACAACBCCAABCBBACCABBBAACABAAAABBBBBBCBBACAAABBC.exe
1⤵
PID:12760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABCBBBACCCCBACBABCCBBAACACBCBCBAABBBCCAACAABBCACBBBBBACCCABBCABABACCBBABBAAAAABAAAAAAAABABBABCABBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAAABACBBBAABCCAABBACBAAAAABACCCCABABCBBABBBCCBBABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCAABBBCCCABCBCACCBACBAAACBAACACCAAAABBCBCAABABBCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCAABBBCCCABCBCACCBACBAAACBAACACCAAAABBCBCAABABBCCCB.exe
1⤵
PID:12548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCABBCCABCACCBCCACAACCACCBAAABCCCAABCBCBBAABCAACCCCCBCBACCCCBCABBACCCABBCBCAACAACCAABBACBCBCBCCABCBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBBBAAABBBCBCBCBBAAAABBBACCCBAACCABBCBABBACCBCAAABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCABBCCABCACCBCCACAACCACCBAAABCCCAABCBCBBAABCAACCCCCBCBACCCCBCABBACCCABBCBCAACAACCAABBACBCBCBCCABCBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBBBAAABBBCBCBCBBAAAABBBACCCBAACCABBCBABBACCBCAAABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8016

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBABBAABBCCAAACCCCBAABCBCBCBBBBCCBAAACBCBCAAAACACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBABBAABBCCAAACCCCBAABCBCBCBBBBCCBAAACBCBCAAAACACBC.exe
1⤵
PID:12660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAABBBBBAABAACAAAAABAACCCAABCACABCABBAAABCCACACBACCCCCCABBACCAABCABBCAAACCBCABBBCBCCCBBAACCBBCABACBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCABABBCBBCCBAAACAACCCBBABBAABCABACBABACCCBBACBBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAABBBBBAABAACAAAAABAACCCAABCACABCABBAAABCCACACBACCCCCCABBACCAABCABBCAAACCBCABBBCBCCCBBAACCBBCABACBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCABABBCBBCCBAAACAACCCBBABBAABCABACBABACCCBBACBBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:13408

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCCABBBAABACBCBBCBACACBCCBAABABCABABACAAACABCAABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCCABBBAABACBCBBCBACACBCCBAABABCABABACAAACABCAABAA.exe
1⤵
PID:7268

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCBCABBAAABCBCBCBCCCAABBCCCBAABABBAAACBAACABBBAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCBCABBAAABCBCBCBCCCAABBCCCBAABABBAAACBAACABBBAABAC.exe
1⤵
PID:1216

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCBCABBAAABCBCBCBCCCAABBCCCBAABABBAAACBAACABBBAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCBCABBAAABCBCBCBCCCAABBCCCBAABABBAAACBAACABBBAABAC.exe
1⤵
PID:13260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCACCABBABBBABAAAACACBAACCCCCCAACACACBCCCBCBABBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCACCABBABBBABAAAACACBAACCCCCCAACACACBCCCBCBABBAAA.exe
1⤵
PID:11920

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCACCABBABBBABAAAACACBAACCCCCCAACACACBCCCBCBABBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCACCABBABBBABAAAACACBAACCCCCCAACACACBCCCBCBABBAAA.exe
1⤵
PID:2992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBBCAAABACAABCCABBBBBCABAAACBBAACCCBCBACAACAABBAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBBCAAABACAABCCABBBBBCABAAACBBAACCCBCBACAACAABBAABA.exe
1⤵
PID:7712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCAAAAABBACACCABCBBABABCBCACAAAABBACBBACBCACBCABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCAAAAABBACACCABCBBABABCBCACAAAABBACBBACBCACBCABBB.exe
1⤵
PID:7440

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBABBAABBCCAAACCCCBAABCBCBCBBBBCCBAAACBCBCAAAACACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBABBAABBCCAAACCCCBAABCBCBCBBBBCCBAAACBCBCAAAACACBC.exe
1⤵
PID:7728

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACCBACCBCBABABBAAABABCACCABABCCBABBAACCCBABBCCBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACCBACCBCBABABBAAABABCACCABABCCBABBAACCCBABBCCBCBA.exe
1⤵
PID:12536

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCACABBCACBBBBAAAAACACCBCACCCABCBAAABCBAAABACBCBCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCACABBCACBBBBAAAAACACCBCACCCABCBAAABCBAAABACBCBCACC.exe
1⤵
PID:11816

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBACBBACCCCCBABCBBAABBBABCACABABCBBBBCCBBABCABAAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBACBBACCCCCBABCBBAABBBABCACABABCBBBBCCBBABCABAAABBB.exe
1⤵
PID:8124

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACABCACAACABABABCBBBAABBBABAAABCABCAAAACBBACBACABCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACABCACAACABABABCBBBAABBBABAAABCABCAAAACBBACBACABCAA.exe
1⤵
PID:12692

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBBCBCAABCBBCCBAABABBCBABBCBCBACCAACCACACCBBBACCACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBBCBCAABCBBCCBAABABBCBABBCBCBACCAACCACACCBBBACCACAC.exe
1⤵
PID:4200

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCAAAAABBACACCABCBBABABCBCACAAAABBACBBACBCACBCABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBCAAAAABBACACCABCBBABABCBCACAAAABBACBBACBCACBCABBB.exe
1⤵
PID:11936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCCAACAABBCABAAACABCAACACBCCBBBBAAACAACBCACAAACAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACCCAACAABBCABAAACABCAACACBCCBBBBAAACAACBCACAAACAAAB.exe
1⤵
PID:13272

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBBBCCCBBBCBCBBBCBCCCBBCACCBCCACBCCBACACACACABBCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBBBCCCBBBCBCBBBCBCCCBBCACCBCCACBCCBACACACACABBCAAC.exe
1⤵
PID:7444

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAABBBAACCCACAABCBAABCCABAACCBBAACCBCCBABABBACCCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAABBBAACCCACAABCBAABCCABAACCBBAACCBCCBABABBACCCACBC.exe
1⤵
PID:7788

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCABAABBCBBCCCACBCBBACBABAABBCABABABAABACCBBCBBCAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCABAABBCBBCCCACBCBBACBABAABBCABABABAABACCBBCBBCAACA.exe
1⤵
PID:5796

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBACCACABBBABACCCABBBCAACBBBBBBAACBBBACACBCCACAACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBACCACABBBABACCCABBBCAACBBBBBBAACBBBACACBCCACAACBCC.exe
1⤵
PID:13132

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBAABACCBCBCACBABBABCABAAABCBBABACBBAAABBCBBCAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBAABACCBCBCACBABBABCABAAABCBBABACBBAAABBCBBCAAABB.exe
1⤵
PID:10776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBABACBCBAACACCBAABAABACCBCABBABCBCBACCBAAABCBBCACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBABACBCBAACACCBAABAABACCBCABBABCBCBACCBAAABCBBCACCB.exe
1⤵
PID:11924

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCACCCBCCCACBCAABACBAAABAACCBABBAABABAACCABBCAABBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCACCCBCCCACBCAABACBAAABAACCBABBAABABAACCABBCAABBCA.exe
1⤵
PID:8712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCABABABAACACAACBCBABACBCAABCABBBAACABCCBAABCBACAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCABABABAACACAACBCBABACBCAABCABBBAACABCCBAABCBACAAC.exe
1⤵
PID:12040

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAAACCCABBBACABBCACBCBBCBCABAABACAACBCCCCBAAAACCCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCAAACCCABBBACABBCACBCBBCBCABAABACAACBCCCCBAAAACCCBCA.exe
1⤵
PID:7852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBBCBCAABCBBCCBAABABBCBABBCBCBACCAACCACACCBBBACCACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBBCBCAABCBBCCBAABABBCBABBCBCBACCAACCACACCBBBACCACAC.exe
1⤵
PID:6016

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBCBCACBCCBBCBCACCCCCCBABAACCBCCCCBBABCCABCCABBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBCBCACBCCBBCBCACCCCCCBABAACCBCCCCBBABCCABCCABBCCC.exe
1⤵
PID:11992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAABBBAACCCACAABCBAABCCABAACCBBAACCBCCBABABBACCCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAABBBAACCCACAABCBAABCCABAACCBBAACCBCCBABABBACCCACBC.exe
1⤵
PID:6308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCAABBBCCCABCBCACCBACBAAACBAACACCAAAABBCBCAABABBCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCAABBBCCCABCBCACCBACBAAACBAACACCAAAABBCBCAABABBCCCB.exe
1⤵
PID:2036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAAABAACAABCCCACAACBBBCCAACAACAACABCABCAABBCABACCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAAABAACAABCCCACAACBBBCCAACAACAACABCABCAABBCABACCCC.exe
1⤵
PID:13332

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABAACAAACAABABCCABAAABCCAABCABCCAABAACABACACBBBBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABAACAAACAABABCCABAAABCCAABCABCCAABAACABACACBBBBCCB.exe
1⤵
PID:13888

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBAACCBBACBBBCCCABCCABBABCBBCCCBABABBAAACABCCBABCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCBAACCBBACBBBCCCABCCABBABCBBCCCBABABBAAACABCCBABCBA.exe
1⤵
PID:13920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ffccdb44bd642643bf40754eb66559e5bffa9fd11357b32d30a97dba3933f8e8
MD5 476a20caa31466cc4daa43a50221d93a
SHA1 f83fb4ebc82a766bfdf7ec97ee8804500fba9a7a
SHA512 2dba14d912af4942dee4fbd62f1d0b7feedca418d9cd94bc2d17e75d48aa8299a5b56963530ec72cb467ce85bae58792a7172bcf58434bd4e72bd854f8b24625
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e6b630d134187b54366dc3e9c64f47b4df9022500f70716dad07919f5986b9a9
MD5 439a4302c167cb45b67efdd5adbab43a
SHA1 2238549425ab9ca23f40900b36e957012cae720a
SHA512 6c7493a80f7ed17ebaeb8a467ebf9513ceebc7a9366c6f56e0e904c1bd878c6beb0b10b8b22661416b7fd624d50fe95951c8b04cd3e8f058e4156d20fbaec2eb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bbd1350e0eeadffdcc4ddbdf47c1f4c69f83880351a42b44995ecfe2ae047f24
MD5 027158dcf945f4ccb5f9e6ce68834e42
SHA1 5d749d205187146a194509114e929b123be158b4
SHA512 c6894fcfb917e3b22e21d945f742be9d89dfc1b641195cadc78d6d5f2d7bf6efc9528b48a9848af903e07e830c0215c5489cd725717c600d10573fa334bb17dc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c99b6849729007200bf2172b133cd148d5c1013f85a203e242d65bfb7112c313
MD5 7bc942b4cbc595851a81ac687817a9fc
SHA1 6cd61615c0d1eb616820f9a4f61da8e6a53b7510
SHA512 d592f5d01a84eb236c5304d5237fb20ac4d93fd9808d258cbef7af251625e5f66b5a734aee7eaee140e545809ed87824d882cd2a067fa29101f6be7b8daaddca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f677b8dd4cbd064a53fe1f5a2970f7dba62c2fbf1b2bd85d09672975c7c5467e
MD5 7d06669bf1c3f5706c1874e7acf6d417
SHA1 6ba6ebccc86479edba42a8c4caa265b496d7e617
SHA512 5dce31e54619d82ef03220fd43611622cbaf40459e47046776f1bf94a76d07c318f28910d305d12080a9d8eaf9df7fbb7441870d0d98c8ea79e6144fc4af1c5a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9d400fda4aebaf4cd08de8f6792a21b0b3a0b30e3d78fe31e4831691d3f8d9e4
MD5 b085bcd2fbe581a5ce1052db82b49311
SHA1 d3857390731dc64130399e21e2f437787d977a43
SHA512 ccaed3e3bad7fefadee686409274a22f74dc8c0bdeae47f823da86d1df092ad9837442e1e324d3359ca101286ee603f748f630ab6887ca51071ebcba9f877f6d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c954d1d93de43b564bb536acfe2f61308641f81f8da7b62074bdd92144f8f37a
MD5 968d6c3d861042268d53ffd6569a3a4c
SHA1 b3cae4a99c7d0f9db8c403a1edd4c1a0005efeec
SHA512 189d496238f67af6ce64b8d68477f2c0ff3cad5238b32aacd86b87c6b16c58a001cc0a7bf61a6314dbe8b515de1984b02dca6e7bae345d2f4a2781ce3140a8d2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 db6e67368120dd9238d68321daf295658874c1245869bec57c04524206d63389
MD5 7c4db142d6f1d0d4cf9ccd7c8c27407e
SHA1 52b0d6953adb36f2bbf8fc923d2c364e2757385d
SHA512 eab70f05c242d98c1c60bd333cdac8a3aa65205fc4e51a005c79b6e99d1ce2a1da25bc22619ab6fc67855dd78d7530039c0ea9d28dc6dac99ed27a5854d30bab
MD5 SHA1 SHA512

Submit Download

svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBBCABBAACBBCBBBCACACACBCBBCBBBACBAAACAACABAABCCAAA.exe
Size 18.7MB
SHA256 6b8a9dce71b56b83bdf839cfb1308edbfd14c2dbd716b08f25112b661f8f0f6d
MD5 040ccf64e773fdc5ca42132d2b9bd264
SHA1 b3a65438c2406811510d52236db9d00d199bce55
SHA512 6bcdd867bed9930ea90866eebefb9acb0c156b09f6e17b739058293351f7646f4d3bcfd3a3ad665416cb9c78acbc2da1b60eebb4a5536caf1898c5478797c09a
SSDEEP 98304:j4TQzzJoDfuBcMv+A73XAZ/IJsiC5sop7cTg:jLzD+F2siC592Tg
TLSH
T1BC177D11FBEA80F5F56351308977927BF735B8064A31DB9B8640DA1F6F33A904D2A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 781dda2af3c7d3ecd5770b9af47de5b6147a0feb09b3ccb267dc240596d4a479
MD5 5553e09c422088035c5a69cabc2b5293
SHA1 837db1177fbb371a67a765b638442b67829f1f70
SHA512 d82a3b54c47d0676ae28124b5aca911ff46916f94f9d130e15ae026622c871595d1e5724633610155e28fcd44c843ada537bb48f8fb273262b50daaccb3729ee
SSDEEP 96:onuM1c2p42YXtP+E1mH8uy1UX4AT+cV911GPxM4PxNhz+wPOhzL2JL201xT64Tny:ihJILaoYRV7Gd7zzYziJi0/hVcD
TLSH
T104B1D826F06AECA7F13164CAB61D9FD24EE8739F9C9C6A44524D8219EB48C32CC1D4F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 ac9f9a612146b0db4e0081b1db4524706791cc812431578cd0c2285aae5b068b
MD5 e5fb8b1fdbb0f434cfbdd2757a8ab785
SHA1 5892fea50d25043241b32f215c8dddd8efc1195a
SHA512 62678dbd51bf03d84e9b587c154296eed8e5005c4af120747c2762e563cb2bc40553d198f742ec4a77222fb2179037537f2c9a76293c9ce0df0cf3cc1c42f659
SSDEEP 96:onuM1c2p42YXtP+E1mH8uy1UX4AT+cV911GPxM4PxNhz+wPOhzL2JL201xT64TnL:ihJILaoYRV7Gd7zzYziJi0/hVcwAi
TLSH
T175B1C926F06AECA7F13154CAB61D9FD24EE8739F9C9C5A44524D8218EB88C32CC1D4F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 f84ead84725955a1c73fc2bb616349d5d8476d93f2b1289f995383954e50a799
MD5 d97b09cd4e08ad2ac7d15bbc071b45ee
SHA1 a818a7d320957b6ea8a398ccaf8f9c87d66fcd62
SHA512 71e9514bbd95803c00fd6cd148b52166a66e7faa4a10dfd0ec6237fad404019c9c2d28f8117247aca43c5ce7bc4fa181beb0db5f3ed8f01a78f753f692f4e3e0
SSDEEP 96:onuM1c2p42YXtP+E1mH8uy1UX4AT+cV911GPxM4PxNhz+wPOhzL2JL201xT64Tnb:ihJILaoYRV7Gd7zzYziJi0/hVcwAeOA
TLSH
T159B1C926F06AECA7F13194CAB61D9FD24EE8739F9C9C5A44524D8218EB88C32CC1D4F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 54d60e36ea12529fdc376dff2b98e7e6930cf6eb85ecc99bd04f1dc63f1398fe
MD5 670a1c1d6bc7db60a71ad5b236d1d82b
SHA1 eed58463594988671901c97f133e9684c4229693
SHA512 0841729897009042f3a4c8e684e645233cda0ded66dbf71a795a679fcbda31d8d81ee5acadb8dfc4fbeadc0907178d89f6ed33c39c99b7e22d14e436f3a26df1
SSDEEP 96:onuM1c2p42YXtP+E1mH8uy1UX4AT+cV911GPxM4PxNhz+wPOhzL2JL201xT64TnY:ihJILaoYRV7Gd7zzYziJi0/hVcwAeOTT
TLSH
T158C1C926F06AECA7F13198CAB61D9FD24EE8739F9C8C5644524D8218EB88C32CC1D4F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 0e4a997e4a68ee4a5e0f9b232efc39f8c9ec4e2227d81478d444876fe386569d
MD5 c391f9d9a23ad2c741c309528b75561d
SHA1 55be9f9be64598e1e337ab2c84d7e4099b498f6d
SHA512 93038c24189939b2c6d68707376b6e7d0d84dd22553b726dcdf21b3028305b647070ba7dda8295313c30a2055019d7d862ca448c221e81eb0e054dfc9f718d5a
SSDEEP 192:ihJILaoYRV7Gd7zzYziJi0/hVcwAeOT+7:oJILaLRVCd7zzYW80h+wAeOTY
TLSH
T1A3D1B726F06AEC67F13154CBA61D9FD24EE8739F9C9C6A4452498218EB8DC32CC1D4F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 7KB
SHA256 b9efa2ff8e306455b1748cb637fd1218c906bfeea0c50c99eb1199206543ab6c
MD5 1b70e60406bca4ff7d2b8af89fcf6e66
SHA1 4406ec038da28b14c93fa34d7ea5672fa83ce6ef
SHA512 8112ab2dc5ab57355ce3f66ac0a90f11d7d1bcca75108d15bf7e55ef32b0bf9f320b9419aa4fdfeaa7bd41beab4da197ce70f907797c57b82e56dfd8954a1162
SSDEEP 192:ihJILaoYRV7Gd7zzYziJi0/hVcwAeOT+yyJRjN5Zl:oJILaLRVCd7zzYW80h+wAeOTdyJRjN57
TLSH
T194F11626E06AFC67F13154CBA61D9FD64EE8739B9C8C2A4456498218F78DC32CC1E4F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 8KB
SHA256 48439d3da004335ae832f5f08e61d5a4de54e8a10dcd7214c4331c362ddbc66f
MD5 1eed8271693cbdb1cf5eaf28e24d663c
SHA1 5c15a167ba829a2214a4fc2e1e9a37b06165cc6d
SHA512 67f70485dd26716a295011e1252e6649af7f08d2ec500fc33097f93e064c73c41b6184e39665bca6fcd9bae721ffdacc04974d75fb56a42d232055f2cb6e5ec4
SSDEEP 192:ihJILaoYRV7Gd7zzYziJi0/hVcwAeOT+yyJRjN5ZgkO6:oJILaLRVCd7zzYW80h+wAeOTdyJRjN5n
TLSH
T1E402F526E06AFC67F13154CBB61D9FD64EE4739F9C8C6A8456498218F789C32CC1A4F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 9KB
SHA256 260b2dd81ddc0321f98a909e0bb18a1fdd6b75aab40014a38e27960dd7d64823
MD5 87a0540c98761c3139a884ec8421d071
SHA1 b5610e9083aed3ce58e9d5b88a5f871acf5c9c0e
SHA512 701e113c1c788468b6f1e7cf3cb828c910825a1bdd6711a99d36c83321775c4b5b8229ddfd3bc120960f0c4af6d630e6b3f2db036671b79190f9b5100a7532ff
SSDEEP 192:ihJILaoYRV7Gd7zzYziJi0/hVcwAeOT+yyJRjN5ZgkOkWiw:oJILaLRVCd7zzYW80h+wAeOTdyJRjN56
TLSH
T114120626F06AFC67F13154CBA61DDFD64EE4739B9C8C6A8456498218F789C32CC1A4F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 9KB
SHA256 5cbc98a4fd052cb474dc06baa180b1a67615c644d0989d0007fbeffe7abbe224
MD5 aa9e39d3bc5b9fc42461365c3b5c7a2b
SHA1 d2db60650847ade167f8750bf1e9fa61a2533176
SHA512 0f3b0af117b6bb7359ba78c0843d91572acf5e46ec8b347a828487a1460dc532c52303b901546b9270dc42a194a3cd2c32748ecd30f792c06db87df0c1327fc3
SSDEEP 192:ihJILaoYRV7Gd7zzYziJi0/hVcwAeOT+yyJRjN5ZgkOkWi5yE68:oJILaLRVCd7zzYW80h+wAeOTdyJRjN5J
TLSH
T16012F626F06AFC67F13154CBA61DDFD14EE8739B9C8C6A8456498118F799C32CC194F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 9KB
SHA256 95b7f47dddda22a7c8521e166118283127b5c9ece2c5a77f2eae53129bdd8efa
MD5 67a5b5a65464c3ee94507edcfa9d9c66
SHA1 3c498ee2ef16d637c2c2d7790753df6cc3f685ab
SHA512 a1805940b46bcc6ccce55d32e2efce5164c8410518e95cc71871aa99536cac35c3f476b0690582d57de9b4b34508d5ed8fbfd604758cc65f55a4356685da1a96
SSDEEP 192:ihJILaoYRV7Gd7zzYziJi0/hVcwAeOT+yyJRjN5ZgkOkWi5yE69C:oJILaLRVCd7zzYW80h+wAeOTdyJRjN5N
TLSH
T13F22F626F06AFC67F23154CBA61DDFD14EE8739B9C8C6A8456498218F799C32CC1A4F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 9KB
SHA256 2da1ecdc9a927d120aad980c2d7bd4e9074bbc419ffead0e6d8659dfe2bbbad8
MD5 c828923e44a73b9834ffd41f820174be
SHA1 25219a4b224d5d0a9596c96c7e4d64cc33d0c9e0
SHA512 cc5ffd2ed99c24331f5883cdd6d42153c2127c4509ae2b65f1c19b35fba4b31ab7b6033ea192f7e7fe103b4bfda5626d005cd5be35b8ff28257a076c90cb3ce1
SSDEEP 192:ihJILaoYRV7Gd7zzYziJi0/hVcwAeOT+yyJRjN5ZgkOkWi5yE69bg:oJILaLRVCd7zzYW80h+wAeOTdyJRjN5X
TLSH
T19122F626F06AFC67F23158CBA61DDFD14EE8739B9C8C6A8456498218F799C32CC194F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 10KB
SHA256 a4f9a2362a525a09f2d8f1b21b04f67c4ff39689e613f37babea4e9863ee6f56
MD5 b9966bd4e101fda77936b0af6192d925
SHA1 68b9187d742ac82e4af6602df0404f8d9a30118a
SHA512 c68c76947b6b65ada1d097c5fb138b3802d5fab2249c0d48aeff99c9d5329cc07d19cd93c577c9a1b161c9d30cad7508a84a516dd01b0009ecc8b1f9f5b7d1e1
SSDEEP 192:ihJILaoYRV7Gd7zzYziJi0/hVcwAeOT+yyJRjN5ZgkOkWi5yE69bHJh:oJILaLRVCd7zzYW80h+wAeOTdyJRjN5w
TLSH
T18722F426F06AFC67F13158CAB61DDFD24EE8779B9C8C6A8452498218F798C32CD194F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 11KB
SHA256 1edd8e477049e6a235d6b26dfde929305d7d2a7e3ee23839ef6b1c10a6831d41
MD5 0db765dfaab431b617805a29b9cd752d
SHA1 3dd34a95ecf61f59c07dfe3efa33114ae2e484c9
SHA512 d7c26a896a2e665519550c4614c00c6d960dca9714176181e1af3343bc47bbf1efdfc2db22c72dd5356839e2accdf2ef1d69a52236c48f55c3cce425a6b8aa20
SSDEEP 192:ihJILaoYRV7Gd7zzYziJi0/hVcwAeOT+yyJRjN5ZgkOkWi5yE69bHJf4RLQ:oJILaLRVCd7zzYW80h+wAeOTdyJRjN5y
TLSH
T190320426F06AFC67F23158C6A61DDFD14EE8779B9C8C2A8056498218F79CC32CD194F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 13KB
SHA256 94c44c3823bd4ebf1b27ca639703970eb489713d55e90874b0edf8464ec82d7c
MD5 b323af961960085e6a4d8d7d95306f74
SHA1 8cdade99173b5acc28d9551ffd1eb06f67bdc3df
SHA512 cb0799a6ef2481278203fa0b37735571d0e179c20da8090fb2f6276f2481100e3a6a84b871952023e2629a2e899fb3040c424240cd29c9eebab2a25252de5228
SSDEEP 384:oJILaLRVCd7zzYW80h+wAeOTdyJRjN5Zgdni5P69bHZ4RavNwCJ:oJILM7Cd7zzx80h+wAtRybjTmdni5P6r
TLSH
T1BC520426E06AF867F13158CBA62DDFD24EE8779B9C8C5A8056498218F79CC32CD194F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 13KB
SHA256 87abc0fbb2dfb614baf6fe712df6870e484fdc7c2b3c6cb44854897ede8df2ff
MD5 75d277f0af830258a77965ee88a53fd5
SHA1 6091d1bc73a4a53e19828eb8d60ea64516f46f8d
SHA512 b14bda892989a4caf8d105a81b9cd58a3d64d0e2d0259ecd23d27d45dd5507b28dc4064d363788102e08d0531383a894df5e8f37f552f5ce4e4784ebb5321bf3
SSDEEP 384:oJILaLRVCd7zzYW80h+wAeOTdyJRjN5Zgdni5P69bHZ4RavNwCM:oJILM7Cd7zzx80h+wAtRybjTmdni5P6i
TLSH
T15C520326E06AFC67F13158CBA62DDFD24EE8779B9C8C5A8056498218F79CC32CD194F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 07b3dcd07b1716ad533fc90f41f9ca78241bc468bc4bfa28f0b4a284ab00fd4b
MD5 f620cf92c0af742c187314acce56740d
SHA1 a530e8611e8c2fae2a030b4734b3cb54c82c7880
SHA512 ded3b0aff86ee23425ade00699b3ab0fa314c3f31842cc82508efe7f05f08f0569462f4157d50b04755963b313ce06757057003454f0cafdded68d6dd2558e42
SSDEEP 384:oJILaLRVCd7zzYW80h+wAeOTdyJRjN5Zgdni5P69bHZ4RavNwCVfUcK:oJILM7Cd7zzx80h+wAtRybjTmdni5P6u
TLSH
T12B52F326E06AFCA7F13158CBA62DDFD14EE8779B9C8C5A8056498218E79CC32CD1D4F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 15KB
SHA256 307d01c3e5fca7f76a8070f4aa984fb95842ff2651d0fbefe928dcd6c3ae66bd
MD5 d0f29bc908bca44cb6c73e7f877f5853
SHA1 4685d6734f9995050ecfc20c4c5fac3ea43ff534
SHA512 527247a349028fc0f3a86b45b526e81f0d4c88a218c99eae9ecfa2f92b92cb2d931291ef2738e02d1c9880da7d6c44f1924ef9c95a96553780195f5ed4d56996
SSDEEP 384:oJILaLRVCd7zzYW80h+wAeOTdyJRjN5Zgdni5P69bHZ4RavNwCVfUcLy:oJILM7Cd7zzx80h+wAtRybjTmdni5P66
TLSH
T10772F426E06AFC67F13158CBA62DDFD24EE8779F9CCC5A8452498218E798C328D194F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 16KB
SHA256 9520099aa6d3cc0c91d04ec37c0fa7905c1021026dbe7a939cea807a2e91ab03
MD5 977570f8cbd39143faa515cb6fe1d3a3
SHA1 4e78cbdcbecc5aa65069e7bdca922abb2d8b7f76
SHA512 cfcc130f9ade54f45d6845e4b3d42dc1617e7632c9f6d46414ce157657991128cbf391788ab22f42757275a4acf641bc84ca027bf485656bdeef5e550288be34
SSDEEP 384:oJILaLRVCd7zzYW80h+wAeOTdyJRjN5Zgdni5P69bHZ4RavNwCVfUcLcFZLq:oJILM7Cd7zzx80h+wAtRybjTmdni5P6x
TLSH
T13F720326E06AFC67F13158CBA62DDFD14EE8779B9C8C1A8456498218F798C32CD194F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 fa22d650ff3608f43e4473e448e43972d475f6afe1fc46fe73c1f3d73f503f11
MD5 d5accc2384c8c9a145dd4e555992f247
SHA1 c8e9a2d7f97a4dc5b775b327658d9e3615dc25b7
SHA512 a2c2a651aedd190da94cda5390475d533fe094cf8f9297fbc9b93812eed3aa2ad4822dc136589ff63b7fdbc647237688050b708be3bd3f0645897cba32ec26b2
TLSH
T1C9212827E06AEC63E13168CBA61B9FC24EE8729F5C8C6B4422594219EB5CC72CD1D4F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 17KB
SHA256 aa18bac664571980c6ea7697fb59e6fe8bfb45204e27cd5960c4cce909942e63
MD5 a544189068a09f693986ee9a72acf47b
SHA1 a99413bbfd532e3f68d69b6e45e9a9881b186328
SHA512 f382c1bb4e1cdaf8b25ad4bdfc5a0b9a4798b0a56c50ba1c013eb22ad1334a0f11ccca9c7d9b772e4dac6c2cf83d6d43e8c280c7def47fe7fb075225081e6c6d
SSDEEP 384:oJILaLRVCd7zzYW80h+wAeOTdyJRjN5Zgdni5P69bHZ4RavNwCVfUcLcFZLETW:oJILM7Cd7zzx80h+wAtRybjTmdni5P6S
TLSH
T1F4720326E06AFC67F13158CBA62DDFD14EE8779F9C8C1A8456498218F798C32CD194F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 18KB
SHA256 5f8f0007ab426deac045b8cca3782350c0db96bda71d1ecb875a916016e4ab80
MD5 d35083117e601fe5f411801fa04a9e90
SHA1 0c188bdbede5ce126aacc42b3cfd581d0f5a4d2c
SHA512 eb36424f1291db817e5ccd4f2bc247383b2965de6aa9ff9f96c884ea966ae073b0ce0fbc9e6385432cda3991b7a3f2481b0cb69c41361bdb2476f8c743e1e3ee
SSDEEP 384:oJILaLRVCd7zzYW80h+wAeOTdyJRjN5Zgdni5P69bHZ4RavNwCVfUcLcFZLETxZa:oJILM7Cd7zzx80h+wAtRybjTmdni5P6a
TLSH
T1F6820326E06AFC67F13158CBA62DDFD14EE8779B9CCC1A8456498218F798C32CD194F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 387306316088a17a5e3d9fec626948e68a7f4581a79ec298fc52d3206c169a3d
MD5 515eeb351caf51556ace6cc86e4ef6ce
SHA1 9c7cbc7d04e563cd0f7416873fe5ba221a25a3ad
SHA512 4085cae282e8bd1381f4c0095ad7a0bc88547ebeb0477134af90661f2268a048d2df061e903a3c97cb029cae9318fc4ffefd5fdf09cf08d5936adc184e84696d
TLSH
T15D510963F06AEC63E13168CBA61E9FD20EE8735F9C8C6A4412594219BB9CC72CD0D4F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 8fd61f55e5240e6963844577fde9868262456c768818ac7942989c39bc733672
MD5 af1fd5355caccc8de0f0f120931e0253
SHA1 b583d66a44bbc8f3ce1a3ac3fe4c917b6fcc2e69
SHA512 935814c8e19e4a4c214f5434a49dc9d4caba77b0513172887cbe30c5ee8090d0f2037ef9e64db7444e0573bd90018f168e1b4edc3adc9434a1d8546a1d9a389c
SSDEEP 96:onuM1c2p42YXtP+E1mH8uy1UX4AT+cV911GPxM4PxNhz+wPOhzL2JL201xT64Tn6:ihJILaoYRV7Gd7zzYziJi0/hVQ
TLSH
T13E91C962F06AEC67F13168CAB61D9FD24DE8735F9C9C6A44124D8219AB9CC32CD1D4F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 a5fc0bfe445b96a89cc5051fae56a41c9f383024fa46cfc627d36b7b2ceec3a5
MD5 79dd282f5d7995632dd6724328247a4c
SHA1 9061744f4d1ea075b0c22f71367a9f935f892c58
SHA512 5b4bf81799a031a4f63e8eef61671f0f8731e00bc68c68cc8b9b64107860d0b2b2ed39654ac277666736b9bc6acd3a64a4927767aaf9188da387a2e41f6d6f86
TLSH
T1D881DB66E06AEC67F13158CAF61D9FD24DE8735F9C9C6A44124D8219AB9CC32CD0D4F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 f9fd25cd3ba83e4636b98e51ba3a79d5377fdedf30cc1fa4c651960a5fd53986
MD5 be2d70226ef6a69ddec1e4a9dddfe074
SHA1 1ce69f87e57f64a008f75270a3445667f5827c0b
SHA512 a07929db5571048413a0f590bac00ab19238a5a25b35a1ad394d22f2ca88348edc70ed3aafe19c728d3958afd78afbf991e61a57138f3946daa2bab0a59df3e7
SSDEEP 96:onuM1c2p42YXtP+E1mH8uy1UX4AT+cV911GPxM4PxNhz+wPOhzL2JL201xT64Tnv:ihJILaoYRV7Gd7zzYziJi0/hv
TLSH
T14291C962F06AEC67F13164CAB61D9FD24DE8735F9C9C6644124D8219AB9CC32CD1D4F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/568-805-0x0000000000DF0000-0x0000000000E12000-memory.dmp

Download

memory/1084-616-0x00000000003F0000-0x0000000000412000-memory.dmp

Download

memory/1084-327-0x00000000003F0000-0x0000000000412000-memory.dmp

Download

memory/1324-140-0x0000000000C30000-0x0000000000C52000-memory.dmp

Download

memory/1324-325-0x0000000000C30000-0x0000000000C52000-memory.dmp

Download

memory/1340-326-0x0000000000C30000-0x0000000000C52000-memory.dmp

Download

memory/1340-162-0x0000000000C30000-0x0000000000C52000-memory.dmp

Download

memory/1372-880-0x0000000000190000-0x00000000001B2000-memory.dmp

Download

memory/1372-618-0x0000000000190000-0x00000000001B2000-memory.dmp

Download

memory/1404-974-0x0000000000E00000-0x0000000000E22000-memory.dmp

Download

memory/1444-670-0x0000000000090000-0x00000000000B2000-memory.dmp

Download

memory/1492-414-0x00000000002C0000-0x00000000002E2000-memory.dmp

Download

memory/1492-593-0x00000000002C0000-0x00000000002E2000-memory.dmp

Download

memory/1616-879-0x0000000000190000-0x00000000001B2000-memory.dmp

Download

memory/1616-617-0x0000000000190000-0x00000000001B2000-memory.dmp

Download

memory/1944-391-0x0000000000450000-0x0000000000472000-memory.dmp

Download

memory/1944-558-0x0000000000450000-0x0000000000472000-memory.dmp

Download

memory/2648-108-0x00000000003B0000-0x00000000003D2000-memory.dmp

Download

memory/2648-65-0x00000000003B0000-0x00000000003D2000-memory.dmp

Download

memory/3096-195-0x0000000000270000-0x0000000000292000-memory.dmp

Download

memory/3096-139-0x0000000000270000-0x0000000000292000-memory.dmp

Download

memory/3192-173-0x00000000002E0000-0x0000000000302000-memory.dmp

Download

memory/3192-266-0x00000000002E0000-0x0000000000302000-memory.dmp

Download

memory/3224-339-0x0000000000990000-0x00000000009B2000-memory.dmp

Download

memory/3224-163-0x0000000000990000-0x00000000009B2000-memory.dmp

Download

memory/3276-14-0x0000000000D10000-0x0000000000D32000-memory.dmp

Download

memory/3276-63-0x0000000000D10000-0x0000000000D32000-memory.dmp

Download

memory/3496-44-0x0000000000240000-0x0000000000262000-memory.dmp

Download

memory/3496-128-0x0000000000240000-0x0000000000262000-memory.dmp

Download

memory/3512-685-0x0000000000480000-0x00000000004A2000-memory.dmp

Download

memory/4140-563-0x0000000000870000-0x0000000000892000-memory.dmp

Download

memory/4140-412-0x0000000000870000-0x0000000000892000-memory.dmp

Download

memory/4240-686-0x0000000000480000-0x00000000004A2000-memory.dmp

Download

memory/4320-597-0x00000000003F0000-0x0000000000412000-memory.dmp

Download

memory/4320-328-0x00000000003F0000-0x0000000000412000-memory.dmp

Download

memory/4372-930-0x0000000000CF0000-0x0000000000D12000-memory.dmp

Download

memory/4432-29-0x0000000000D10000-0x0000000000D32000-memory.dmp

Download

memory/4432-13-0x0000000000D10000-0x0000000000D32000-memory.dmp

Download

memory/4440-762-0x0000000000090000-0x00000000000B2000-memory.dmp

Download

memory/4532-12-0x0000000000AC0000-0x0000000000AE2000-memory.dmp

Download

memory/4532-0-0x0000000000AC0000-0x0000000000AE2000-memory.dmp

Download

memory/4664-194-0x0000000000270000-0x0000000000292000-memory.dmp

Download

memory/4664-138-0x0000000000270000-0x0000000000292000-memory.dmp

Download

memory/4720-1058-0x0000000000C60000-0x0000000000C82000-memory.dmp

Download

memory/4896-413-0x00000000002C0000-0x00000000002E2000-memory.dmp

Download

memory/4896-592-0x00000000002C0000-0x00000000002E2000-memory.dmp

Download

memory/4960-806-0x0000000000DF0000-0x0000000000E12000-memory.dmp

Download

memory/5160-267-0x00000000002E0000-0x0000000000302000-memory.dmp

Download

memory/5160-174-0x00000000002E0000-0x0000000000302000-memory.dmp

Download

memory/5480-137-0x00000000003B0000-0x00000000003D2000-memory.dmp

Download

memory/5480-66-0x00000000003B0000-0x00000000003D2000-memory.dmp

Download

memory/5584-358-0x0000000000990000-0x00000000009B2000-memory.dmp

Download

memory/5584-164-0x0000000000990000-0x00000000009B2000-memory.dmp

Download

memory/5700-509-0x0000000000110000-0x0000000000132000-memory.dmp

Download

memory/5700-365-0x0000000000110000-0x0000000000132000-memory.dmp

Download

memory/5776-45-0x0000000000240000-0x0000000000262000-memory.dmp

Download

memory/5776-132-0x0000000000240000-0x0000000000262000-memory.dmp

Download

memory/6116-361-0x0000000000470000-0x0000000000492000-memory.dmp

Download

memory/6176-366-0x0000000000110000-0x0000000000132000-memory.dmp

Download

memory/6176-510-0x0000000000110000-0x0000000000132000-memory.dmp

Download

memory/6352-559-0x0000000000450000-0x0000000000472000-memory.dmp

Download

memory/6352-392-0x0000000000450000-0x0000000000472000-memory.dmp

Download

memory/6400-362-0x0000000000470000-0x0000000000492000-memory.dmp

Download

memory/6544-975-0x0000000000E00000-0x0000000000E22000-memory.dmp

Download