98adbc20f51bdfebbb67d6466bc2e17ad9888a2241c7f19bb5d1b40bf89aa6c8

Analysis

max time kernel
105s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_7fc2f51efc0d16c68d629cd88f704972_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
Size 52.2MB
Sample260719-dpth9aav8k
SHA256 98adbc20f51bdfebbb67d6466bc2e17ad9888a2241c7f19bb5d1b40bf89aa6c8
MD5 7fc2f51efc0d16c68d629cd88f704972
SHA1 6db6a326e5eef729ceed1d3e93475cc8621a28a1
SHA512 29d191c5e8d14454f9a9ed8bc5ffc39655ca0af3d23a8e18e8bee69a3b48d621d55f3d1032a9f8454e28eabb6755b0ee0c11c59c81df87a763dc877d69f0a6ca
SSDEEP 196608:pLzD+FhGnmLzD+FhGnmLzD+FhGnhKWQc0gEYnvL6:1sG8sG8sGocZEIvG
TLSH
T1B7C78D01FADA81F5E593463089A7D27FA730B8098731DBDFD6449A5EAD33AD04D3A312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_AABBBCCACACCAACABCCCCAACBCBCAAAAACCCCCACABACACABBBBCABB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	2026-07-19_7fc2f51efc0d16c68d629cd88f704972_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe

Executes dropped EXE 45 IoCs

pid	Process
2036	svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe
4736	svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe
2568	svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe
5764	svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe
2264	svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe
4080	svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe
2684	svchost_BCACBACBCACCCBBAABBBCCCAAAAABBBCACACBCAABBCCBACAABBCCBC.exe
1888	svchost_BCAABBCCBCBCCCBBBBACBACBACAABAACBBBACAABABBBCCCBBBAACBA.exe
5676	svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe
5476	svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe
4116	svchost_AABBBCCACACCAACABCCCCAACBCBCAAAAACCCCCACABACACABBBBCABB.exe
4180	svchost_BABBBAABCCBAABCCCAAACBBACAACCCBBCABAACABBCBCABCBBBCBABB.exe
6120	svchost_BABBBAABCCBAABCCCAAACBBACAACCCBBCABAACABBCBCABCBBBCBABB.exe
6048	svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe
2776	svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe
2108	svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe
3972	svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe
1028	svchost_BABCABACCCCCBBAAACBAACCCCCAABCBCCBACAABCAABBBBAABBACBCC.exe
4872	svchost_CACAABBABCAAACACBAAAACCCACBACBAABBCCCABABCABCCCBCBBACBC.exe
244	svchost_BABCABACCCCCBBAAACBAACCCCCAABCBCCBACAABCAABBBBAABBACBCC.exe
2424	svchost_CACAABBABCAAACACBAAAACCCACBACBAABBCCCABABCABCCCBCBBACBC.exe
252	svchost_BBBACBBBBBCCACCCCCCBACCBBCCCCACACBABBBBACAAAABACBCCCBCA.exe
1236	svchost_BACBBCACBCBBCAACCBCABABAABACCABBBACACCBBACBABAAACBACCBC.exe
5256	svchost_BBBACBBBBBCCACCCCCCBACCBBCCCCACACBABBBBACAAAABACBCCCBCA.exe
4932	svchost_BACBBCACBCBBCAACCBCABABAABACCABBBACACCBBACBABAAACBACCBC.exe
2720	svchost_AAAAACACBABCCAABABACCABCABCBBBCACAAABCACABABBCCBCACAAAB.exe
5276	svchost_AAAAACACBABCCAABABACCABCABCBBBCACAAABCACABABBCCBCACAAAB.exe
4828	svchost_CBBCBCBBBABCAABBBAABCBABCABBAABACABACCBBACBBAAAACAAAACC.exe
3184	svchost_CBBCBCBBBABCAABBBAABCBABCABBAABACABACCBBACBBAAAACAAAACC.exe
6952	svchost_AACBBACAAACCCBCBCCBCBABCCACABABABBAACBCBACAACCBCCBACBAC.exe
1292	svchost_CACBBCAAABCCCAAAACCAAACACACABCABCBCACABBABBCABACCABBCBA.exe
6332	svchost_AACBBACAAACCCBCBCCBCBABCCACABABABBAACBCBACAACCBCCBACBAC.exe
6312	svchost_CACBBCAAABCCCAAAACCAAACACACABCABCBCACABBABBCABACCABBCBA.exe
7080	svchost_AABCACAACBABACCAAACBACACBAACCABACCAACCAACCACBBCCCCACCBA.exe
6340	svchost_AABCACAACBABACCAAACBACACBAACCABACCAACCAACCACBBCCCCACCBA.exe
6668	svchost_CBBCBBCBCABCBBCAAAAACCBCCCCAAAAAACCACABBCBAAABBBBCAAAAA.exe
7116	svchost_BCAACABCACAACBAACAAABBCBBABCAAACABBBAABABAAACACBBAAAABB.exe
6644	svchost_BCAACABCACAACBAACAAABBCBBABCAAACABBBAABABAAACACBBAAAABB.exe
6592	svchost_CBBAACCBBBBCCCCACBBCAABCACCBBBBBBBCBCCBABBBBCCACAACBBBA.exe
6620	svchost_CBBAACCBBBBCCCCACBBCAABCACCBBBBBBBCBCCBABBBBCCACAACBBBA.exe
6784	svchost_BCCBBABBCCBACCBBCCBACABAABBBCBBCAACACAACACCBCBCCBBCCBCC.exe
6520	svchost_BCCBBABBCCBACCBBCCBACABAABBBCBBCAACACAACACCBCBCCBBCCBCC.exe
6628	svchost_CCCACBAAACCBCCAAACBAAABABCCBBBCCBABBCABCBBBBCCAACAAAABA.exe
7040	svchost_CCCACBAAACCBCCAAACBAAABABCCBBBCCBABBCABCBBBBCCAACAAAABA.exe
7676	svchost_ABBBCACABCACABCCCBAACBBABAAAAAABBBABBCCCBBBBABACBACBBAA.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBBBCACCABAABBBABCAABBBCCBACCBCCCCBABBACCACCCCCABCBCCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAABBCCBCBCCCBBBBACBACBACAABAACBBBACAABABBBCCCBBBAACBA.exe"	svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAABCABBABBBAAAACCBCBCBBBABBCCCCBCABACCBAABBCBCBCCCBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACBBACAAACCCBCBCCBCBABCCACABABABBAACBCBACAACCBCCBACBAC.exe"	svchost_BABCABACCCCCBBAAACBAACCCCCAABCBCCBACAABCAABBBBAABBACBCC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCCACCCBCCBABBBCBACBCCCCBBCCCCAACAACACCAABBCAAAABAAABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBBCAAABCCCAAAACCAAACACACABCABCBCACABBABBCABACCABBCBA.exe"	svchost_CACAABBABCAAACACBAAAACCCACBACBAABBCCCABABCABCCCBCBBACBC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAAABBBCBBCBBAACBABAAAABBACABCCACBBCCACBCCCABBABCBBBACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCBBCBCABCBBCAAAAACCBCCCCAAAAAACCACABBCBAAABBBBCAAAAA.exe"	svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBBBACBBBBABBAAAABCBBCBACACBBCBABCACACCAABABBCABBBCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBCACABCACABCCCBAACBBABAAAAAABBBABBCCCBBBBABACBACBBAA.exe"	svchost_BCCBBABBCCBACCBBCCBACABAABBBCBBCAACACAACACCBCBCCBBCCBCC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBACCCBBAAAACCACCCCBABCBBCBACACCACCCABAABABAACACBABCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAACACACCAACCACCCCBBABBCCCCBCCCCBACABBCCCBBCABCCABBCCC.exe"	svchost_CCCACBAAACCBCCAAACBAAABABCCBBBCCBABBCABCBBBBCCAACAAAABA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBCACACABABACCABCBCBAACBCCAACCBCBCABAACABAACCCAABBCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe"	svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABABCAABACACCBBCBCABABCCACCCCCABCBCCBBCCBCCCBAAACCABCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe"	svchost_AABBBCCACACCAACABCCCCAACBCBCAAAAACCCCCACABACACABBBBCABB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBABCABAABCCCBCCCCCABBAACABBCACCCCAAAAAACCAACCCCCBBCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe"	2026-07-19_7fc2f51efc0d16c68d629cd88f704972_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBBBABCCCACCCBBAABCAAACCBBBBCCBACAABAABAABACCBCABCBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe"	svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACACBCBBAABABBCBCAACBACBACBBACCAABAAABBABBCAAAABABBACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCAAABACCACCACACAABBAAAABBCBABCCAABBBAABBBCAABBAABCBC.exe"	svchost_BBBACBBBBBCCACCCCCCBACCBBCCCCACACBABBBBACAAAABACBCCCBCA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACACBCABCBCAACACBBABBBCAACABBCBACBACCABACCBCCABACAABCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe"	svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBBBBACCAAABBCCBBCCCCBBCACAABACCABCCAAAABABBBAAACCBBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACAABBABCAAACACBAAAACCCACBACBAABBCCCABABCABCCCBCBBACBC.exe"	svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBABCAAABCACACABBACCBCCBACBCCAAACABCACABAAAABACABBAABABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBBCACBCBBCAACCBCABABAABACCABBBACACCBBACBABAAACBACCBC.exe"	svchost_BABBBAABCCBAABCCCAAACBBACAACCCBBCABAACABBCBCABCBBBCBABB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBCCABCABACBABCCACCCCBAAACABACAACBACCBBBCBBBCCCCBCBBBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBAACCBBBBCCCCACBBCAABCACCBBBBBBBCBCCBABBBBCCACAACBBBA.exe"	svchost_CBBCBCBBBABCAABBBAABCBABCABBAABACABACCBBACBBAAAACAAAACC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCBABBBAACABCBACACBACBBCCACCBABCCBCACABACBCBCACACCCAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBCAAABBCCBAACBBBAABBBCACBCBAABBBBBCCBCBAABBCCACABCCA.exe"	svchost_BACBBCACBCBBCAACCBCABABAABACCABBBACACCBBACBABAAACBACCBC.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5720	sc.exe
3824	sc.exe
7296	sc.exe
2648	sc.exe
4600	sc.exe
6296	sc.exe
8752	sc.exe
10876	sc.exe
6580	sc.exe
6232	sc.exe
5824	sc.exe
4888	sc.exe
6128	sc.exe
296	sc.exe
2592	sc.exe
2384	sc.exe
9996	sc.exe
6436	sc.exe
6384	sc.exe
7656	sc.exe
7792	sc.exe
8016	sc.exe
9084	sc.exe
2292	sc.exe
3736	sc.exe
6608	sc.exe
8412	sc.exe
8716	sc.exe
5992	sc.exe
11092	sc.exe
6732	sc.exe
7088	sc.exe
9316	sc.exe
9960	sc.exe
10792	sc.exe
7428	sc.exe
4104	sc.exe
6196	sc.exe
3284	sc.exe
6912	sc.exe
8540	sc.exe
8076	sc.exe
2104	sc.exe
4868	sc.exe
768	sc.exe
4924	sc.exe
1020	sc.exe
7328	sc.exe
2584	sc.exe
964	sc.exe
2892	sc.exe
2432	sc.exe
8188	sc.exe
3736	sc.exe
6748	sc.exe
10860	sc.exe
1132	sc.exe
5332	sc.exe
6904	sc.exe
6384	sc.exe
1904	sc.exe
6104	sc.exe
11228	sc.exe
3416	sc.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7084	cmd.exe
8776	cmd.exe
9388	cmd.exe
7588	cmd.exe
4432	cmd.exe
4524	cmd.exe
6560	cmd.exe
2844	cmd.exe
5820	cmd.exe
9896	cmd.exe
6612	cmd.exe
2892	cmd.exe
8460	cmd.exe
6720	cmd.exe
3428	cmd.exe
4892	cmd.exe
4600	cmd.exe
10664	cmd.exe
2372	cmd.exe
5724	cmd.exe
6796	cmd.exe
7392	cmd.exe
6372	cmd.exe
5100	cmd.exe
2072	cmd.exe
6184	cmd.exe
6768	cmd.exe
7900	cmd.exe
7244	cmd.exe
8448	cmd.exe
7868	cmd.exe
1216	cmd.exe
8492	cmd.exe
9140	cmd.exe
10404	cmd.exe
10040	cmd.exe
2788	cmd.exe
6584	cmd.exe
7200	cmd.exe
7416	cmd.exe
6460	cmd.exe
1964	cmd.exe
5312	cmd.exe
5712	cmd.exe
1052	cmd.exe
7984	cmd.exe
5516	cmd.exe
4408	cmd.exe
932	cmd.exe
8236	cmd.exe
8468	cmd.exe
10364	cmd.exe
4972	cmd.exe
5528	cmd.exe
1900	cmd.exe
3632	cmd.exe
3944	cmd.exe
9492	cmd.exe
9372	cmd.exe
11200	cmd.exe
1064	cmd.exe
2976	cmd.exe
9536	cmd.exe
10208	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCABACCCCCBBAAACBAACCCCCAABCBCCBACAABCAABBBBAABBACBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBAACCBBBBCCCCACBBCAABCACCBBBBBBBCBCCBABBBBCCACAACBBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBBAABCCBAABCCCAAACBBACAACCCBBCABAACABBCBCABCBBBCBABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACAABBABCAAACACBAAAACCCACBACBAABBCCCABABCABCCCBCBBACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCBCBBBABCAABBBAABCBABCABBAABACABACCBBACBBAAAACAAAACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBBCAAABCCCAAAACCAAACACACABCABCBCACABBABBCABACCABBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCACBAAACCBCCAAACBAAABABCCBBBCCBABBCABCBBBBCCAACAAAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBBABBCCBACCBBCCBACABAABBBCBBCAACACAACACCBCBCCBBCCBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBBCACBCBBCAACCBCABABAABACCABBBACACCBBACBABAAACBACCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBCACABCACABCCCBAACBBABAAAAAABBBABBCCCBBBBABACBACBBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCABACCCCCBBAAACBAACCCCCAABCBCCBACAABCAABBBBAABBACBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBACBBBBBCCACCCCCCBACCBBCCCCACACBABBBBACAAAABACBCCCBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACBACBCACCCBBAABBBCCCAAAAABBBCACACBCAABBCCBACAABBCCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBBAABCCBAABCCCAAACBBACAACCCBBCABAACABBCBCABCBBBCBABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBACBBBBBCCACCCCCCBACCBBCCCCACACBABBBBACAAAABACBCCCBCA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4732	schtasks.exe
2820	schtasks.exe
8464	schtasks.exe
10984	schtasks.exe
4260	schtasks.exe
6312	schtasks.exe
10024	schtasks.exe
2708	schtasks.exe
3332	schtasks.exe
4328	schtasks.exe
9596	schtasks.exe
10972	schtasks.exe
6368	schtasks.exe
7236	schtasks.exe
10304	schtasks.exe
4128	schtasks.exe
1984	schtasks.exe
944	schtasks.exe
2296	schtasks.exe
8252	schtasks.exe
7300	schtasks.exe
2044	schtasks.exe
4516	schtasks.exe
2288	schtasks.exe
6664	schtasks.exe
10928	schtasks.exe
11244	schtasks.exe
1300	schtasks.exe
11156	schtasks.exe
2712	schtasks.exe
8124	schtasks.exe
7416	schtasks.exe
10288	schtasks.exe
2572	schtasks.exe
2532	schtasks.exe
2564	schtasks.exe
8868	schtasks.exe
3704	schtasks.exe
6728	schtasks.exe
6896	schtasks.exe
10896	schtasks.exe
11044	schtasks.exe
4236	schtasks.exe
5364	schtasks.exe
3624	schtasks.exe
9368	schtasks.exe
7136	schtasks.exe
7428	schtasks.exe
9948	schtasks.exe
7700	schtasks.exe
2892	schtasks.exe
2524	schtasks.exe
4724	schtasks.exe
8748	schtasks.exe
6352	schtasks.exe
7288	schtasks.exe
8308	schtasks.exe
3040	schtasks.exe
6264	schtasks.exe
7592	schtasks.exe
8436	schtasks.exe
9416	schtasks.exe
3276	schtasks.exe
252	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6084	2026-07-19_7fc2f51efc0d16c68d629cd88f704972_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
6084	2026-07-19_7fc2f51efc0d16c68d629cd88f704972_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
2036	svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe
2036	svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe
4736	svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe
4736	svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe
6084	2026-07-19_7fc2f51efc0d16c68d629cd88f704972_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
6084	2026-07-19_7fc2f51efc0d16c68d629cd88f704972_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
2568	svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe
2568	svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe
5764	svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe
5764	svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe
2264	svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe
2264	svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe
4080	svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe
4080	svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe
4736	svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe
4736	svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe
5676	svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe
5676	svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe
5476	svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe
5476	svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe
4116	svchost_AABBBCCACACCAACABCCCCAACBCBCAAAAACCCCCACABACACABBBBCABB.exe
4116	svchost_AABBBCCACACCAACABCCCCAACBCBCAAAAACCCCCACABACACABBBBCABB.exe
2776	svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe
2776	svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe
6048	svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe
6048	svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe
4180	svchost_BABBBAABCCBAABCCCAAACBBACAACCCBBCABAACABBCBCABCBBBCBABB.exe
4180	svchost_BABBBAABCCBAABCCCAAACBBACAACCCBBCABAACABBCBCABCBBBCBABB.exe
6120	svchost_BABBBAABCCBAABCCCAAACBBACAACCCBBCABAACABBCBCABCBBBCBABB.exe
6120	svchost_BABBBAABCCBAABCCCAAACBBACAACCCBBCABAACABBCBCABCBBBCBABB.exe
2684	svchost_BCACBACBCACCCBBAABBBCCCAAAAABBBCACACBCAABBCCBACAABBCCBC.exe
2684	svchost_BCACBACBCACCCBBAABBBCCCAAAAABBBCACACBCAABBCCBACAABBCCBC.exe
1888	svchost_BCAABBCCBCBCCCBBBBACBACBACAABAACBBBACAABABBBCCCBBBAACBA.exe
1888	svchost_BCAABBCCBCBCCCBBBBACBACBACAABAACBBBACAABABBBCCCBBBAACBA.exe
5764	svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe
5764	svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe
4080	svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe
4080	svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe
1028	svchost_BABCABACCCCCBBAAACBAACCCCCAABCBCCBACAABCAABBBBAABBACBCC.exe
1028	svchost_BABCABACCCCCBBAAACBAACCCCCAABCBCCBACAABCAABBBBAABBACBCC.exe
4872	svchost_CACAABBABCAAACACBAAAACCCACBACBAABBCCCABABCABCCCBCBBACBC.exe
4872	svchost_CACAABBABCAAACACBAAAACCCACBACBAABBCCCABABCABCCCBCBBACBC.exe
244	svchost_BABCABACCCCCBBAAACBAACCCCCAABCBCCBACAABCAABBBBAABBACBCC.exe
244	svchost_BABCABACCCCCBBAAACBAACCCCCAABCBCCBACAABCAABBBBAABBACBCC.exe
2424	svchost_CACAABBABCAAACACBAAAACCCACBACBAABBCCCABABCABCCCBCBBACBC.exe
2424	svchost_CACAABBABCAAACACBAAAACCCACBACBAABBCCCABABCABCCCBCBBACBC.exe
2108	svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe
2108	svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe
3972	svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe
3972	svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe
3184	svchost_CBBCBCBBBABCAABBBAABCBABCABBAABACABACCBBACBBAAAACAAAACC.exe
4828	svchost_CBBCBCBBBABCAABBBAABCBABCABBAABACABACCBBACBBAAAACAAAACC.exe
4828	svchost_CBBCBCBBBABCAABBBAABCBABCABBAABACABACCBBACBBAAAACAAAACC.exe
3184	svchost_CBBCBCBBBABCAABBBAABCBABCABBAABACABACCBBACBBAAAACAAAACC.exe
2108	svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe
2108	svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe
5476	svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe
5476	svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe
6784	svchost_BCCBBABBCCBACCBBCCBACABAABBBCBBCAACACAACACCBCBCCBBCCBCC.exe
6784	svchost_BCCBBABBCCBACCBBCCBACABAABBBCBBCAACACAACACCBCBCCBBCCBCC.exe
6520	svchost_BCCBBABBCCBACCBBCCBACABAABBBCBBCAACACAACACCBCBCCBBCCBCC.exe
6520	svchost_BCCBBABBCCBACCBBCCBACABAABBBCBBCAACACAACACCBCBCCBBCCBCC.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	6084	2026-07-19_7fc2f51efc0d16c68d629cd88f704972_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
Token: SeDebugPrivilege	2036	svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe
Token: SeDebugPrivilege	4736	svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe
Token: SeDebugPrivilege	2568	svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe
Token: SeDebugPrivilege	5764	svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe
Token: SeDebugPrivilege	4080	svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe
Token: SeDebugPrivilege	2264	svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe
Token: SeDebugPrivilege	5676	svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe
Token: SeDebugPrivilege	5476	svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe
Token: SeDebugPrivilege	4116	svchost_AABBBCCACACCAACABCCCCAACBCBCAAAAACCCCCACABACACABBBBCABB.exe
Token: SeDebugPrivilege	2776	svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe
Token: SeDebugPrivilege	6048	svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe
Token: SeDebugPrivilege	4180	svchost_BABBBAABCCBAABCCCAAACBBACAACCCBBCABAACABBCBCABCBBBCBABB.exe
Token: SeDebugPrivilege	6120	svchost_BABBBAABCCBAABCCCAAACBBACAACCCBBCABAACABBCBCABCBBBCBABB.exe
Token: SeDebugPrivilege	2684	svchost_BCACBACBCACCCBBAABBBCCCAAAAABBBCACACBCAABBCCBACAABBCCBC.exe
Token: SeDebugPrivilege	1888	svchost_BCAABBCCBCBCCCBBBBACBACBACAABAACBBBACAABABBBCCCBBBAACBA.exe
Token: SeDebugPrivilege	1028	svchost_BABCABACCCCCBBAAACBAACCCCCAABCBCCBACAABCAABBBBAABBACBCC.exe
Token: SeDebugPrivilege	4872	svchost_CACAABBABCAAACACBAAAACCCACBACBAABBCCCABABCABCCCBCBBACBC.exe
Token: SeDebugPrivilege	2424	svchost_CACAABBABCAAACACBAAAACCCACBACBAABBCCCABABCABCCCBCBBACBC.exe
Token: SeDebugPrivilege	244	svchost_BABCABACCCCCBBAAACBAACCCCCAABCBCCBACAABCAABBBBAABBACBCC.exe
Token: SeDebugPrivilege	2108	svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe
Token: SeDebugPrivilege	3972	svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe
Token: SeDebugPrivilege	3184	svchost_CBBCBCBBBABCAABBBAABCBABCABBAABACABACCBBACBBAAAACAAAACC.exe
Token: SeDebugPrivilege	4828	svchost_CBBCBCBBBABCAABBBAABCBABCABBAABACABACCBBACBBAAAACAAAACC.exe
Token: SeDebugPrivilege	6784	svchost_BCCBBABBCCBACCBBCCBACABAABBBCBBCAACACAACACCBCBCCBBCCBCC.exe
Token: SeDebugPrivilege	6520	svchost_BCCBBABBCCBACCBBCCBACABAABBBCBBCAACACAACACCBCBCCBBCCBCC.exe
Token: SeDebugPrivilege	6628	svchost_CCCACBAAACCBCCAAACBAAABABCCBBBCCBABBCABCBBBBCCAACAAAABA.exe
Token: SeDebugPrivilege	7040	svchost_CCCACBAAACCBCCAAACBAAABABCCBBBCCBABBCABCBBBBCCAACAAAABA.exe
Token: SeDebugPrivilege	252	svchost_BBBACBBBBBCCACCCCCCBACCBBCCCCACACBABBBBACAAAABACBCCCBCA.exe
Token: SeDebugPrivilege	1236	svchost_BACBBCACBCBBCAACCBCABABAABACCABBBACACCBBACBABAAACBACCBC.exe
Token: SeDebugPrivilege	5256	svchost_BBBACBBBBBCCACCCCCCBACCBBCCCCACACBABBBBACAAAABACBCCCBCA.exe
Token: SeDebugPrivilege	4932	svchost_BACBBCACBCBBCAACCBCABABAABACCABBBACACCBBACBABAAACBACCBC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6084 wrote to memory of 1088	6084	2026-07-19_7fc2f51efc0d16c68d629cd88f704972_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe	89
PID 1088 wrote to memory of 2044	1088	cmd.exe	91
PID 6084 wrote to memory of 2388	6084	2026-07-19_7fc2f51efc0d16c68d629cd88f704972_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe	92
PID 2388 wrote to memory of 5824	2388	cmd.exe	94
PID 6084 wrote to memory of 5856	6084	2026-07-19_7fc2f51efc0d16c68d629cd88f704972_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe	95
PID 5856 wrote to memory of 4868	5856	cmd.exe	97
PID 4736 wrote to memory of 4972	4736	svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe	101
PID 2036 wrote to memory of 4880	2036	svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe	103
PID 4880 wrote to memory of 2708	4880	cmd.exe	105
PID 4972 wrote to memory of 3332	4972	cmd.exe	107
PID 2036 wrote to memory of 1936	2036	svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe	108
PID 4736 wrote to memory of 5528	4736	svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe	110
PID 1936 wrote to memory of 964	1936	cmd.exe	112
PID 5528 wrote to memory of 4888	5528	cmd.exe	113
PID 2036 wrote to memory of 1388	2036	svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe	114
PID 4736 wrote to memory of 5100	4736	svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe	116
PID 1388 wrote to memory of 1488	1388	cmd.exe	118
PID 5100 wrote to memory of 6128	5100	cmd.exe	119
PID 2568 wrote to memory of 2372	2568	svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe	126
PID 5764 wrote to memory of 3428	5764	svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe	128
PID 2372 wrote to memory of 4236	2372	cmd.exe	130
PID 2568 wrote to memory of 1680	2568	svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe	131
PID 3428 wrote to memory of 4260	3428	cmd.exe	133
PID 1680 wrote to memory of 3532	1680	cmd.exe	134
PID 5764 wrote to memory of 4820	5764	svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe	135
PID 2568 wrote to memory of 4432	2568	svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe	136
PID 4432 wrote to memory of 4324	4432	cmd.exe	139
PID 4820 wrote to memory of 768	4820	cmd.exe	140
PID 5764 wrote to memory of 5376	5764	svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe	141
PID 5376 wrote to memory of 4168	5376	cmd.exe	143
PID 4080 wrote to memory of 4864	4080	svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe	147
PID 2264 wrote to memory of 1964	2264	svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe	149
PID 4864 wrote to memory of 2820	4864	cmd.exe	152
PID 1964 wrote to memory of 2892	1964	cmd.exe	153
PID 4080 wrote to memory of 3008	4080	svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe	155
PID 3008 wrote to memory of 4668	3008	cmd.exe	157
PID 4080 wrote to memory of 5032	4080	svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe	158
PID 5032 wrote to memory of 2292	5032	cmd.exe	160
PID 5676 wrote to memory of 2696	5676	svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe	165
PID 2696 wrote to memory of 1300	2696	cmd.exe	167
PID 5676 wrote to memory of 2788	5676	svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe	169
PID 5476 wrote to memory of 1240	5476	svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe	170
PID 2788 wrote to memory of 2720	2788	cmd.exe	173
PID 1240 wrote to memory of 4128	1240	cmd.exe	174
PID 5676 wrote to memory of 5312	5676	svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe	175
PID 5476 wrote to memory of 5444	5476	svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe	177
PID 5312 wrote to memory of 4860	5312	cmd.exe	179
PID 5444 wrote to memory of 5720	5444	cmd.exe	180
PID 5476 wrote to memory of 1440	5476	svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe	182
PID 1440 wrote to memory of 5592	1440	cmd.exe	186
PID 4116 wrote to memory of 5724	4116	svchost_AABBBCCACACCAACABCCCCAACBCBCAAAAACCCCCACABACACABBBBCABB.exe	189
PID 5724 wrote to memory of 252	5724	cmd.exe	192
PID 4116 wrote to memory of 5712	4116	svchost_AABBBCCACACCAACABCCCCAACBCBCAAAAACCCCCACABACACABBBBCABB.exe	193
PID 5712 wrote to memory of 296	5712	cmd.exe	195
PID 4116 wrote to memory of 1900	4116	svchost_AABBBCCACACCAACABCCCCAACBCBCAAAAACCCCCACABACACABBBBCABB.exe	196
PID 1900 wrote to memory of 2892	1900	cmd.exe	198
PID 2776 wrote to memory of 1052	2776	svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe	201
PID 6048 wrote to memory of 4192	6048	svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe	202
PID 1052 wrote to memory of 2532	1052	cmd.exe	205
PID 4192 wrote to memory of 2712	4192	cmd.exe	208
PID 2776 wrote to memory of 4524	2776	svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe	209
PID 6048 wrote to memory of 960	6048	svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe	211
PID 4524 wrote to memory of 4600	4524	cmd.exe	213
PID 960 wrote to memory of 1812	960	cmd.exe	214

C:\Users\Admin\AppData\Local\Temp\2026-07-19_7fc2f51efc0d16c68d629cd88f704972_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_7fc2f51efc0d16c68d629cd88f704972_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBABCABAABCCCBCCCCCABBAACABBCACCCCAAAAAACCAACCCCCBBCACBCCCBAAAABACCACCCCBCABCBABCCCCCBCAAAACABBCBAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBABCABAABCCCBCCCCCABBAACABBCACCCCAAAAAACCAACCCCCBBCACBCCCBAAAABACCACCCCBCABCBABCCCCCBCAAAACABBCBAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCCCACCCCACAABCCCCBBAACCACCBCAACCAACCABCACABBACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe" start= auto displayName= "UserDataSvc_CACCCCACCCCACAABCCCCBBAACCACCBCAACCAACCABCACABBACBC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACCCCACCCCACAABCCCCBBAACCACCBCAACCAACCABCACABBACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe" start= auto displayName= "UserDataSvc_CACCCCACCCCACAABCCCCBBAACCACCBCAACCAACCABCACABBACBC"
    3⤵
    - Launches sc.exe
    PID:5824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCCCACCCCACAABCCCCBBAACCACCBCAACCAACCABCACABBACBC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5856
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACCCCACCCCACAABCCCCBBAACCACCBCAACCAACCABCACABBACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBACCCBCCBBBABBABCCABABBBABCBBABCCCAABABBACCCBACCAAAAACBBCBACCBBBCCBACCAAAABBACBBCCACAACCACBCCBBBCCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBACCCBCCBBBABBABCCABABBBABCBBABCCCAABABBACCCBACCAAAAACBBCBACCBBBCCBACCAAAABBACBBCCACAACCACBCCBBBCCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACCAAABCBBBAACACBCBCAACACCCBCABCABABBACCCCCACCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe" start= auto displayName= "UserDataSvc_CCACCAAABCBBBAACACBCBCAACACCCBCABCABABBACCCCCACCCCA"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCACCAAABCBBBAACACBCBCAACACCCBCABCABABBACCCCCACCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe" start= auto displayName= "UserDataSvc_CCACCAAABCBBBAACACBCBCAACACCCBCABCABABBACCCCCACCCCA"
    3⤵
    - Launches sc.exe
    PID:964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACCAAABCBBBAACACBCBCAACACCCBCABCABABBACCCCCACCCCA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCACCAAABCBBBAACACBCBCAACACCCBCABCABABBACCCCCACCCCA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1488

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCAAABABBBCABCCBBABCBABABBBBBACABACAABBACCBABBAAABCBB.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACBCABCBCAACACBBABBBCAACABBCBACBACCABACCBCCABACAABCBBCABBAACABBACBCACACCCACBAAACBABACCBACBBBACBCCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACBCABCBCAACACBBABBBCAACABBCBACBACCABACCBCCABACAABCBBCABBAACABBACBCACACCCACBAAACBABACCBACBBBACBCCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBCBBACCAABBBAABABCACCABACBCBABCAACBCACBCCAAACAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe" start= auto displayName= "UserDataSvc_ABCBCBBACCAABBBAABABCACCABACBCBABCAACBCACBCCAAACAAB"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5528
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBCBBACCAABBBAABABCACCABACBCBABCAACBCACBCCAAACAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe" start= auto displayName= "UserDataSvc_ABCBCBBACCAABBBAABABCACCABACBCBABCAACBCACBCCAAACAAB"
    3⤵
    - Launches sc.exe
    PID:4888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBCBBACCAABBBAABABCACCABACBCBABCAACBCACBCCAAACAAB"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBCBBACCAABBBAABABCACCABACBCBABCAACBCACBCCAAACAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6128

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCAAAAABBACACBBABBCCAAAACABBBCACCBCAAACAABBCCCCABBCCCAABBAAACABCABACCABCBACCAABABCCBAABBABCBAACACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBACBCACCCBBAABBBCCCAAAAABBBCACACBCAABBCCBACAABBCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCAAAAABBACACBBABBCCAAAACABBBCACCBCAAACAABBCCCCABBCCCAABBAAACABCABACCABCBACCAABABCCBAABBABCBAACACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBACBCACCCBBAABBBCCCAAAAABBBCACACBCAABBCCBACAABBCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACBABBCABCAABCCBCCCCAABBBABCCAAABAACCBBACAABABACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBACBCACCCBBAABBBCCCAAAAABBBCACACBCAABBCCBACAABBCCBC.exe" start= auto displayName= "UserDataSvc_ABACBABBCABCAABCCBCCCCAABBBABCCAAABAACCBBACAABABACA"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACBABBCABCAABCCBCCCCAABBBABCCAAABAACCBBACAABABACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBACBCACCCBBAABBBCCCAAAAABBBCACACBCAABBCCBACAABBCCBC.exe" start= auto displayName= "UserDataSvc_ABACBABBCABCAABCCBCCCCAABBBABCCAAABAACCBBACAABABACA"
    3⤵
    PID:3532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACBABBCABCAABCCBCCCCAABBBABCCAAABAACCBBACAABABACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACBABBCABCAABCCBCCCCAABBBABCCAAABAACCBBACAABABACA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4324

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCBACBCBBACABBBCACCABCAACACBAACBACCAAAABCBABBABACB.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBCACCABAABBBABCAABBBCCBACCBCCCCBABBACCACCCCCABCBCCACBCCABACABBCBCBACCCCCCCBCCAAABABCAABAABCCCCBBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCBCBCCCBBBBACBACBACAABAACBBBACAABABBBCCCBBBAACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBCACCABAABBBABCAABBBCCBACCBCCCCBABBACCACCCCCABCBCCACBCCABACABBCBCBACCCCCCCBCCAAABABCAABAABCCCCBBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCBCBCCCBBBBACBACBACAABAACBBBACAABABBBCCCBBBAACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCCBBCACBBBCABBCBBBAAABBACCBBCCCCBBBACCCBACBBACAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCBCBCCCBBBBACBACBACAABAACBBBACAABABBBCCCBBBAACBA.exe" start= auto displayName= "UserDataSvc_ABCCBBCACBBBCABBCBBBAAABBACCBBCCCCBBBACCCBACBBACAAA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCCBBCACBBBCABBCBBBAAABBACCBBCCCCBBBACCCBACBBACAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCBCBCCCBBBBACBACBACAABAACBBBACAABABBBCCCBBBAACBA.exe" start= auto displayName= "UserDataSvc_ABCCBBCACBBBCABBCBBBAAABBACCBBCCCCBBBACCCBACBBACAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCCBBCACBBBCABBCBBBAAABBACCBBCCCCBBBACCCBACBBACAAA"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5376
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCCBBCACBBBCABBCBBBAAABBACCBBCCCCBBBACCCBACBBACAAA"
    3⤵
    PID:4168

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACCBBAACBACACCCBCBBBACAAACBBAACBBBCBABAABCACBCBABCCAABBBABBABAABABCCCBBCAAAACBCBACABBACCBBBACBCABACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBCCACACCAACABCCCCAACBCBCAAAAACCCCCACABACACABBBBCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACCBBAACBACACCCBCBBBACAAACBBAACBBBCBABAABCACBCBABCCAABBBABBABAABABCCCBBCAAAACBCBACABBACCBBBACBCABACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBCCACACCAACABCCCCAACBCBCAAAAACCCCCACABACACABBBBCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAACABCBAACCBCBACAAAAACBABCBBAABCCAACABABCBACACBCABC.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBCACACABABACCABCBCBAACBCCAACCBCBCABAACABAACCCAABBCACBBBCAABAABCCABACAABBBAAAAAAACCBBCACCCCBAACBAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBCACACABABACCABCBCBAACBCCAACCBCBCABAACABAACCCAABBCACBBBCAABAABCCABACAABBBAAAAAAACCBBCACCCCBAACBAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABCBBBBABBCAAAACABABBCCACAACAACCCACCCBCCABACABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe" start= auto displayName= "UserDataSvc_BCABCBBBBABBCAAAACABABBCCACAACAACCCACCCBCCABACABBCC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABCBBBBABBCAAAACABABBCCACAACAACCCACCCBCCABACABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe" start= auto displayName= "UserDataSvc_BCABCBBBBABBCAAAACABABBCCACAACAACCCACCCBCCABACABBCC"
    3⤵
    PID:4668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABCBBBBABBCAAAACABABBCCACAACAACCCACCCBCCABACABBCC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABCBBBBABBCAAAACABABBCCACAACAACCCACCCBCCABACABBCC"
    3⤵
    - Launches sc.exe
    PID:2292

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBACBCACCCBBAABBBCCCAAAAABBBCACACBCAABBCCBACAABBCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBACBCACCCBBAABBBCCCAAAAABBBCACACBCAABBCCBACAABBCCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAABBBABAACBABCBACBCAACBBACBAABBAABBCABCBCCCBAACBCABBBBBACCBBBBAAABBBACAABBBBBBCAAABCCCCCBCCABCBCAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACACBABCCAABABACCABCABCBBBCACAAABCACABABBCCBCACAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAABBBABAACBABCBACBCAACBBACBAABBAABBCABCBCCCBAACBCABBBBBACCBBBBAAABBBACAABBBBBBCAAABCCCCCBCCABCBCAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACACBABCCAABABACCABCABCBBBCACAAABCACABABBCCBCACAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACBCABCBABACAACBABCCBACABCACCBAACBCACAACCABAAACBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACACBABCCAABABACCABCABCBBBCACAAABCACABABBCCBCACAAAB.exe" start= auto displayName= "UserDataSvc_AACBCABCBABACAACBABCCBACABCACCBAACBCACAACCABAAACBCC"
  2⤵
  PID:1336
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACBCABCBABACAACBABCCBACABCACCBAACBCACAACCABAAACBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACACBABCCAABABACCABCABCBBBCACAAABCACABABBCCBCACAAAB.exe" start= auto displayName= "UserDataSvc_AACBCABCBABACAACBABCCBACABCACCBAACBCACAACCABAAACBCC"
    3⤵
    - Launches sc.exe
    PID:5332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACBCABCBABACAACBABCCBACABCACCBAACBCACAACCABAAACBCC"
  2⤵
  PID:2880
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACBCABCBABACAACBABCCBACABCACCBAACBCACAACCABAAACBCC"
    3⤵
    PID:5808

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCBCBCCCBBBBACBACBACAABAACBBBACAABABBBCCCBBBAACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCBCBCCCBBBBACBACBACAABAACBBBACAABABBBCCCBBBAACBA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACACBABBCCCBAACBBCCBCCBCABABCBCCAACBABBCAAAABBCABCBCBBABCBCCCABAACCBBBBCBBCCCABACAAACCCABBBAABCACAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCBBBABCAABBBAABCBABCABBAABACABACCBBACBBAAAACAAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:3632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACACBABBCCCBAACBBCCBCCBCABABCBCCAACBABBCAAAABBCABCBCBBABCBCCCABAACCBBBBCBBCCCABACAAACCCABBBAABCACAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCBBBABCAABBBAABCBABCABBAABACABACCBBACBBAAAACAAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCCBBCCBCACBCBACACBACACBCACACBAAABBAAAABABABBABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCBBBABCAABBBAABCBABCABBAABACABACCBBACBBAAAACAAAACC.exe" start= auto displayName= "UserDataSvc_BCCCBBCCBCACBCBACACBACACBCACACBAAABBAAAABABABBABBBB"
  2⤵
  - Executes a command shell one-liner
  PID:1216
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCCBBCCBCACBCBACACBACACBCACACBAAABBAAAABABABBABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCBBBABCAABBBAABCBABCABBAABACABACCBBACBBAAAACAAAACC.exe" start= auto displayName= "UserDataSvc_BCCCBBCCBCACBCBACACBACACBCACACBAAABBAAAABABABBABBBB"
    3⤵
    - Launches sc.exe
    PID:4924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCCBBCCBCACBCBACACBACACBCACACBAAABBAAAABABABBABBBB"
  2⤵
  - Executes a command shell one-liner
  PID:4600
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCCBBCCBCACBCBACACBACACBCACACBAAABBAAAABABABBABBBB"
    3⤵
    - Launches sc.exe
    PID:4104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAAACCCCABACBABCBCCCABCAAACCBBABBACBACACCCABABBCACBCBAABCBAABACAACCCACCABBCCACABBAACCCBACACCCCCAACCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBAABCCBAABCCCAAACBBACAACCCBBCABAACABBCBCABCBBBCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAAACCCCABACBABCBCCCABCAAACCBBABBACBACACCCABABBCACBCBAABCBAABACAACCCACCABBCCACABBAACCCBACACCCCCAACCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBAABCCBAABCCCAAACBBACAACCCBBCABAACABBCBCABCBBBCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBAABCCBAABCCCAAACBBACAACCCBBCABAACABBCBCABCBBBCBABB.exe" start= auto displayName= "UserDataSvc_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBA"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBAABCCBAABCCCAAACBBACAACCCBBCABAACABBCBCABCBBBCBABB.exe" start= auto displayName= "UserDataSvc_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBA"
    3⤵
    PID:2720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBA"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5312
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBA"
    3⤵
    PID:4860

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCCABABBCCCACBBCBCAAACCAAAAAABACCACACBABBBBCABBAACBB.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBBABCCCACCCBBAABCAAACCBBBBCCBACAABAABAABACCBCABCBCCCCBCACABBABBACAACBABCCCAAAACCABCCAAAAACAAABBCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBBABCCCACCCBBAABCAAACCBBBBCCBACAABAABAABACCBCABCBCCCCBCACABBABBACAACBABCCCAAAACCABCCAAAAACAAABBCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAACCACBBCCCCBAACACABCCBCBBBCBBCBACBBBABACABCCBAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe" start= auto displayName= "UserDataSvc_AAACCACBBCCCCBAACACABCCBCBBBCBBCBACBBBABACABCCBAABA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5444
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAACCACBBCCCCBAACACABCCBCBBBCBBCBACBBBABACABCCBAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe" start= auto displayName= "UserDataSvc_AAACCACBBCCCCBAACACABCCBCBBBCBBCBACBBBABACABCCBAABA"
    3⤵
    - Launches sc.exe
    PID:5720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAACCACBBCCCCBAACACABCCBCBBBCBBCBACBBBABACABCCBAABA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAACCACBBCCCCBAACACABCCBCBBBCBBCBACBBBABACABCCBAABA"
    3⤵
    PID:5592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBCCACACCAACABCCCCAACBCBCAAAAACCCCCACABACACABBBBCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBCCACACCAACABCCCCAACBCBCAAAAACCCCCACABACACABBBBCABB.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABCAABACACCBBCBCABABCCACCCCCABCBCCBBCCBCCCBAAACCABCAAAACABACBBCCABAAAABACCCCCBBBCCCBBABABAAABCBAAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABCAABACACCBBCBCABABCCACCCCCABCBCCBBCCBCCCBAAACCABCAAAACABACBBCCABAAAABACCCCCBBBCCCBBABABAAABCBAAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACBCCBABBABBABCABABBBCACBBCACACCCABBABABBAACAACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe" start= auto displayName= "UserDataSvc_ABACBCCBABBABBABCABABBBCACBBCACACCCABBABABBAACAACAC"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACBCCBABBABBABCABABBBCACBBCACACCCABBABABBAACAACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe" start= auto displayName= "UserDataSvc_ABACBCCBABBABBABCABABBBCACBBCACACCCABBABABBAACAACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACBCCBABBABBABCABABBBCACBBCACACCCABBABABBAACAACAC"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACBCCBABBABBABCABABBBCACBBCACACCCABBABABBAACAACAC"
    3⤵
    - Launches sc.exe
    PID:2892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBAABCCBAABCCCAAACBBACAACCCBBCABAACABBCBCABCBBBCBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBAABCCBAABCCCAAACBBACAACCCBBCABAACABBCBCABCBBBCBABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAAABBABAABBCCCCBBBBBACACBBABCABCBCAAACBBCBBAAAACABBABCBCACCCBCAABABCBBACCCCAAAAABAAABBCCBBAAABCBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBBBBBCCACCCCCCBACCBBCCCCACACBABBBBACAAAABACBCCCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAAABBABAABBCCCCBBBBBACACBBABCABCBCAAACBBCBBAAAACABBABCBCACCCBCAABABCBBACCCCAAAAABAAABBCCBBAAABCBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBBBBBCCACCCCCCBACCBBCCCCACACBABBBBACAAAABACBCCCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBCAAABAACABCBBAAACCCCBABBCCCBAAABAAABCCBCBCBBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBBBBBCCACCCCCCBACCBBCCCCACACBABBBBACAAAABACBCCCBCA.exe" start= auto displayName= "UserDataSvc_BCCBCAAABAACABCBBAAACCCCBABBCCCBAAABAAABCCBCBCBBCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1064
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBCAAABAACABCBBAAACCCCBABBCCCBAAABAAABCCBCBCBBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBBBBBCCACCCCCCBACCBBCCCCACACBABBBBACAAAABACBCCCBCA.exe" start= auto displayName= "UserDataSvc_BCCBCAAABAACABCBBAAACCCCBABBCCCBAAABAAABCCBCBCBBCBC"
    3⤵
    PID:4924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBCAAABAACABCBBAAACCCCBABBCCCBAAABAAABCCBCBCBBCBC"
  2⤵
  PID:6076
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBCAAABAACABCBBAAACCCCBABBCCCBAAABAAABCCBCBCBBCBC"
    3⤵
    PID:864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBAABCCBAABCCCAAACBBACAACCCBBCABAACABBCBCABCBBBCBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBAABCCBAABCCCAAACBBACAACCCBBCABAACABBCBCABCBBBCBABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCAAABCACACABBACCBCCBACBCCAAACABCACABAAAABACABBAABABBBBCABCABACACCABABBBBCBCACABBBCABABCAAAABCCCAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCACBCBBCAACCBCABABAABACCABBBACACCBBACBABAAACBACCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:2072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCAAABCACACABBACCBCCBACBCCAAACABCACABAAAABACABBAABABBBBCABCABACACCABABBBBCBCACABBBCABABCAAAABCCCAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCACBCBBCAACCBCABABAABACCABBBACACCBBACBABAAACBACCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBBACCABACABBBACCACAACCACCACCCACBBACABCBBBBCBAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCACBCBBCAACCBCABABAABACCABBBACACCBBACBABAAACBACCBC.exe" start= auto displayName= "UserDataSvc_BCBBBACCABACABBBACCACAACCACCACCCACBBACABCBBBBCBAAAA"
  2⤵
  PID:1300
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBBACCABACABBBACCACAACCACCACCCACBBACABCBBBBCBAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCACBCBBCAACCBCABABAABACCABBBACACCBBACBABAAACBACCBC.exe" start= auto displayName= "UserDataSvc_BCBBBACCABACABBBACCACAACCACCACCCACBBACABCBBBBCBAAAA"
    3⤵
    PID:2752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBBACCABACABBBACCACAACCACCACCCACBBACABCBBBBCBAAAA"
  2⤵
  PID:4128
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBBACCABACABBBACCACAACCACCACCCACBBACABCBBBBCBAAAA"
    3⤵
    PID:6104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBABCCAAAACCCCACBBCBAACACAAACCBABCACCCAACAAABBBBBBCBCCCABBACACABCBCBBCBCBBACBCCCACCACBBCABCAAAABBBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABACCCCCBBAAACBAACCCCCAABCBCCBACAABCAABBBBAABBACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBABCCAAAACCCCACBBCBAACACAAACCBABCACCCAACAAABBBBBBCBCCCABBACACABCBCBBCBCBBACBCCCACCACBBCABCAAAABBBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABACCCCCBBAAACBAACCCCCAABCBCCBACAABCAABBBBAABBACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCCCAACACACCBACCCBAACABCCBACACCCABABABAABAACBCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABACCCCCBBAAACBAACCCCCAABCBCCBACAABCAABBBBAABBACBCC.exe" start= auto displayName= "UserDataSvc_CACCCCAACACACCBACCCBAACABCCBACACCCABABABAABAACBCABC"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACCCCAACACACCBACCCBAACABCCBACACCCABABABAABAACBCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABACCCCCBBAAACBAACCCCCAABCBCCBACAABCAABBBBAABBACBCC.exe" start= auto displayName= "UserDataSvc_CACCCCAACACACCBACCCBAACABCCBACACCCABABABAABAACBCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCCCAACACACCBACCCBAACABCCBACACCCABABABAABAACBCABC"
  2⤵
  - Executes a command shell one-liner
  PID:4408
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACCCCAACACACCBACCCBAACABCCBACACCCABABABAABAACBCABC"
    3⤵
    - Launches sc.exe
    PID:2592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACABCACBCAABBCCCBBAABABCBCBBBBBBABBBCBBBBACABBACCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCABCACCACCBAACACBBBBCABCBBAACCCBBBACBCBBBACBACCAAABCABCACABAAACBBBBBBCBAABCCCACAABAAACCACAABBACABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABBABCAAACACBAAAACCCACBACBAABBCCCABABCABCCCBCBBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCABCACCACCBAACACBBBBCABCBBAACCCBBBACBCBBBACBACCAAABCABCACABAAACBBBBBBCBAABCCCACAABAAACCACAABBACABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABBABCAAACACBAAAACCCACBACBAABBCCCABABCABCCCBCBBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABBAACBCCAACCCABBCABBBBCCCACAABBBCBCCBCCABAACBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABBABCAAACACBAAAACCCACBACBAABBCCCABABCABCCCBCBBACBC.exe" start= auto displayName= "UserDataSvc_CCABBAACBCCAACCCABBCABBBBCCCACAABBBCBCCBCCABAACBCCA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABBAACBCCAACCCABBCABBBBCCCACAABBBCBCCBCCABAACBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABBABCAAACACBAAAACCCACBACBAABBCCCABABCABCCCBCBBACBC.exe" start= auto displayName= "UserDataSvc_CCABBAACBCCAACCCABBCABBBBCCCACAABBBCBCCBCCABAACBCCA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABBAACBCCAACCCABBCABBBBCCCACAABBBCBCCBCCABAACBCCA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4920
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABBAACBCCAACCCABBCABBBBCCCACAABBBCBCCBCCABAACBCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3736

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCABBBCCAAABACACBCBAACCAABBACCBBCBBCBBBBCACBAABAABCAAACBBACACCCCCBAAABCBBACCBBCBCCCBBCBBCBABCBBCBCBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABBCCBACCBBCCBACABAABBBCBBCAACACAACACCBCBCCBBCCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCABBBCCAAABACACBCBAACCAABBACCBBCBBCBBBBCACBAABAABCAAACBBACACCCCCBAAABCBBACCBBCBCCCBBCBBCBABCBBCBCBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABBCCBACCBBCCBACABAABBBCBBCAACACAACACCBCBCCBBCCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBCBCBBBCCAABCBBCAAACCBAAACCACCBBABBCCBABCBBACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABBCCBACCBBCCBACABAABBBCBBCAACACAACACCBCBCCBBCCBCC.exe" start= auto displayName= "UserDataSvc_CBCBCBCBBBCCAABCBBCAAACCBAAACCACCBBABBCCBABCBBACBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6584
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBCBCBBBCCAABCBBCAAACCBAAACCACCBBABBCCBABCBBACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABBCCBACCBBCCBACABAABBBCBBCAACACAACACCBCBCCBBCCBCC.exe" start= auto displayName= "UserDataSvc_CBCBCBCBBBCCAABCBBCAAACCBAAACCACCBBABBCCBABCBBACBCA"
    3⤵
    - Launches sc.exe
    PID:6608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBCBCBBBCCAABCBBCAAACCBAAACCACCBBABBCCBABCBBACBCA"
  2⤵
  - Executes a command shell one-liner
  PID:6768
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBCBCBBBCCAABCBBCAAACCBAAACCACCBBABBCCBABCBBACBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6384

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBBBACCACBBBACCAACCABBCCAAACCBAABCAABCABAACACABACBB.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAAABBBCBBCBBAACBABAAAABBACABCCACBBCCACBCCCABBABCBBBACAACACCACBBCAABCABCAACACCCBBCCACBBBAACCCAAABCACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBCBCABCBBCAAAAACCBCCCCAAAAAACCACABBCBAAABBBBCAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAAABBBCBBCBBAACBABAAAABBACABCCACBBCCACBCCCABBABCBBBACAACACCACBBCAABCABCAACACCCBBCCACBBBAACCCAAABCACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBCBCABCBBCAAAAACCBCCCCAAAAAACCACABBCBAAABBBBCAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBCBCBBBCCAABCBBCAAACCBAAACCACCBBABBCCBABCBBACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBCBCABCBBCAAAAACCBCCCCAAAAAACCACABBCBAAABBBBCAAAAA.exe" start= auto displayName= "UserDataSvc_CBCBCBCBBBCCAABCBBCAAACCBAAACCACCBBABBCCBABCBBACBCA"
  2⤵
  - Executes a command shell one-liner
  PID:6612
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBCBCBBBCCAABCBBCAAACCBAAACCACCBBABBCCBABCBBACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBCBCABCBBCAAAAACCBCCCCAAAAAACCACABBCBAAABBBBCAAAAA.exe" start= auto displayName= "UserDataSvc_CBCBCBCBBBCCAABCBBCAAACCBAAACCACCBBABBCCBABCBBACBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3284

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABACCCCCBBAAACBAACCCCCAABCBCCBACAABCAABBBBAABBACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABACCCCCBBAAACBAACCCCCAABCBCCBACAABCAABBBBAABBACBCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBACBABBCBAACCCCCAACAABAABCBABCCACCBACBBACCCACAACABABBBCCACCACCCCAACBACCCBABBBBCCCCCBAACCCBAABCCBBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBACAAACCCBCBCCBCBABCCACABABABBAACBCBACAACCBCCBACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBACBABBCBAACCCCCAACAABAABCBABCCACCBACBBACCCACAACABABBBCCACCACCCCAACBACCCBABBBBCCCCCBAACCCBAABCCBBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBACAAACCCBCBCCBCBABCCACABABABBAACBCBACAACCBCCBACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCAABBBABCACACACCCAAACACCAAACBBACCAAAAAAABBAAACBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBACAAACCCBCBCCBCBABCCACABABABBAACBCBACAACCBCCBACBAC.exe" start= auto displayName= "UserDataSvc_BBCAABBBABCACACACCCAAACACCAAACBBACCAAAAAAABBAAACBBA"
  2⤵
  - Executes a command shell one-liner
  PID:6184
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCAABBBABCACACACCCAAACACCAAACBBACCAAAAAAABBAAACBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBACAAACCCBCBCCBCBABCCACABABABBAACBCBACAACCBCCBACBAC.exe" start= auto displayName= "UserDataSvc_BBCAABBBABCACACACCCAAACACCAAACBBACCAAAAAAABBAAACBBA"
    3⤵
    PID:6332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCAABBBABCACACACCCAAACACCAAACBBACCAAAAAAABBAAACBBA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6432
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCAABBBABCACACACCCAAACACCAAACBBACCAAAAAAABBAAACBBA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABBABCAAACACBAAAACCCACBACBAABBCCCABABCABCCCBCBBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABBABCAAACACBAAAACCCACBACBAABBCCCABABCABCCCBCBBACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCACCCBCCBABBBCBACBCCCCBBCCCCAACAACACCAABBCAAAABAAABACCBCCACACBBCAABBCABCBABBBACCCABCBCBABAAAAACBCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCAAABCCCAAAACCAAACACACABCABCBCACABBABBCABACCABBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCACCCBCCBABBBCBACBCCCCBBCCCCAACAACACCAABBCAAAABAAABACCBCCACACBBCAABBCABCBABBBACCCABCBCBABAAAAACBCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCAAABCCCAAAACCAAACACACABCABCBCACABBABBCABACCABBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBABBABBBABAAABAABBCBABCAAAABACCBBCACABCBABCABABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCAAABCCCAAAACCAAACACACABCABCBCACABBABBCABACCABBCBA.exe" start= auto displayName= "UserDataSvc_AABBABBABBBABAAABAABBCBABCAAAABACCBBCACABCBABCABABA"
  2⤵
  PID:6284
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBABBABBBABAAABAABBCBABCAAAABACCBBCACABCBABCABABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCAAABCCCAAAACCAAACACACABCABCBCACABBABBCABACCABBCBA.exe" start= auto displayName= "UserDataSvc_AABBABBABBBABAAABAABBCBABCAAAABACCBBCACABCBABCABABA"
    3⤵
    - Launches sc.exe
    PID:6384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBABBABBBABAAABAABBCBABCAAAABACCBBCACABCBABCABABA"
  2⤵
  - Executes a command shell one-liner
  PID:6796
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBABBABBBABAAABAABBCBABCAAAABACCBBCACABCBABCABABA"
    3⤵
    - Launches sc.exe
    PID:1020

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABACCCCCBBAAACBAACCCCCAABCBCCBACAABCAABBBBAABBACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABACCCCCBBAAACBAACCCCCAABCBCCBACAABCAABBBBAABBACBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAABCCAAACBCCBACCBCBACABACBCAAAACABCABBCABACCABABCCCCCBABBBCBAAACABACAABCBCBABBCAABACAACACABBACCACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABCACAACBAACAAABBCBBABCAAACABBBAABABAAACACBBAAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:932
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAABCCAAACBCCBACCBCBACABACBCAAAACABCABBCABACCABABCCCCCBABBBCBAAACABACAABCBCBABBCAABACAACACABBACCACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABCACAACBAACAAABBCBBABCAAACABBBAABABAAACACBBAAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABBACBBCACBAACCACABBABACACCCBABAABAAACCCBCCBBCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABCACAACBAACAAABBCBBABCAAACABBBAABABAAACACBBAAAABB.exe" start= auto displayName= "UserDataSvc_BCABBACBBCACBAACCACABBABACACCCBABAABAAACCCBCCBBCAAB"
  2⤵
  - Executes a command shell one-liner
  PID:6460
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABBACBBCACBAACCACABBABACACCCBABAABAAACCCBCCBBCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABCACAACBAACAAABBCBBABCAAACABBBAABABAAACACBBAAAABB.exe" start= auto displayName= "UserDataSvc_BCABBACBBCACBAACCACABBABACACCCBABAABAAACCCBCCBBCAAB"
    3⤵
    - Launches sc.exe
    PID:3824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABBACBBCACBAACCACABBABACACCCBABAABAAACCCBCCBBCAAB"
  2⤵
  PID:6208
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABBACBBCACBAACCACABBABACACCCBABAABAAACCCBCCBBCAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6904

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABBABCAAACACBAAAACCCACBACBAABBCCCABABCABCCCBCBBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAABBABCAAACACBAAAACCCACBACBAABBCCCABABCABCCCBCBBACBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACCABACBAACBCABAACBBAABABCABBABACACABCBCACABACBACBCCAABABABBACBACBCCCACCBBCABBAABBCBCCCCACBAABCCAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACAACBABACCAAACBACACBAACCABACCAACCAACCACBBCCCCACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACCABACBAACBCABAACBBAABABCABBABACACABCBCACABACBACBCCAABABABBACBACBCCCACCBBCABBAABBCBCCCCACBAABCCAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACAACBABACCAAACBACACBAACCABACCAACCAACCACBBCCCCACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAAABACBAABABABCCABCBCCCBCCCCCBBCBAACAAABCACBAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACAACBABACCAAACBACACBAACCABACCAACCAACCACBBCCCCACCBA.exe" start= auto displayName= "UserDataSvc_BBAAABACBAABABABCCABCBCCCBCCCCCBBCBAACAAABCACBAABBA"
  2⤵
  PID:6524
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAAABACBAABABABCCABCBCCCBCCCCCBBCBAACAAABCACBAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACAACBABACCAAACBACACBAACCABACCAACCAACCACBBCCCCACCBA.exe" start= auto displayName= "UserDataSvc_BBAAABACBAABABABCCABCBCCCBCCCCCBBCBAACAAABCACBAABBA"
    3⤵
    - Launches sc.exe
    PID:6196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAAABACBAABABABCCABCBCCCBCCCCCBBCBAACAAABCACBAABBA"
  2⤵
  PID:6188
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAAABACBAABABABCCABCBCCCBCCCCCBBCBAACAAABCACBAABBA"
    3⤵
    - Launches sc.exe
    PID:6296

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBBBBBCCACCCCCCBACCBBCCCCACACBABBBBACAAAABACBCCCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBBBBBCCACCCCCCBACCBBCCCCACACBABBBBACAAAABACBCCCBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACBCBBAABABBCBCAACBACBACBBACCAABAAABBABBCAAAABABBACCCAACACCCCABABCACBABACABBBACCCBACCCBCBCBCACCCABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAABACCACCACACAABBAAAABBCBABCCAABBBAABBBCAABBAABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7524
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACBCBBAABABBCBCAACBACBACBBACCAABAAABBABBCAAAABABBACCCAACACCCCABABCACBABACABBBACCCBACCCBCBCBCACCCABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAABACCACCACACAABBAAAABBCBABCCAABBBAABBBCAABBAABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCBBCBCACCBBAACBBAABBBAAABACACBBCBABBBABCBBAABBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAABACCACCACACAABBAAAABBCBABCCAABBBAABBBCAABBAABCBC.exe" start= auto displayName= "UserDataSvc_CCCBBCBCACCBBAACBBAABBBAAABACACBBCBABBBABCBBAABBCAA"
  2⤵
  PID:4896
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCBBCBCACCBBAACBBAABBBAAABACACBBCBABBBABCBBAABBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAABACCACCACACAABBAAAABBCBABCCAABBBAABBBCAABBAABCBC.exe" start= auto displayName= "UserDataSvc_CCCBBCBCACCBBAACBBAABBBAAABACACBBCBABBBABCBBAABBCAA"
    3⤵
    - Launches sc.exe
    PID:7656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCBBCBCACCBBAACBBAABBBAAABACACBBCBABBBABCBBAABBCAA"
  2⤵
  PID:8000
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCBBCBCACCBBAACBBAABBBAAABACACBBCBABBBABCBBAABBCAA"
    3⤵
    - Launches sc.exe
    PID:2432

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCACBCBBCAACCBCABABAABACCABBBACACCBBACBABAAACBACCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCACBCBBCAACCBCABABAABACCABBBACACCBBACBABAAACBACCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBABBBAACABCBACACBACBBCCACCBABCCBCACABACBCBCACACCCAAACCACCCACCAABBBBACCCACBBBBCCCBCACACBBBCBBBABCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCAAABBCCBAACBBBAABBBCACBCBAABBBBBCCBCBAABBCCACABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBABBBAACABCBACACBACBBCCACCBABCCBCACABACBCBCACACCCAAACCACCCACCAABBBBACCCACBBBBCCCBCACACBBBCBBBABCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCAAABBCCBAACBBBAABBBCACBCBAABBBBBCCBCBAABBCCACABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCACCABAABBBCABCBCAAABABCCABBAACBCCBBCCBCBACCBCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCAAABBCCBAACBBBAABBBCACBCBAABBBBBCCBCBAABBCCACABCCA.exe" start= auto displayName= "UserDataSvc_ABCACCABAABBBCABCBCAAABABCCABBAACBCCBBCCBCBACCBCCBA"
  2⤵
  - Executes a command shell one-liner
  PID:2892
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCACCABAABBBCABCBCAAABABCCABBAACBCCBBCCBCBACCBCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCAAABBCCBAACBBBAABBBCACBCBAABBBBBCCBCBAABBCCACABCCA.exe" start= auto displayName= "UserDataSvc_ABCACCABAABBBCABCBCAAABABCCABBAACBCCBBCCBCBACCBCCBA"
    3⤵
    - Launches sc.exe
    PID:2648

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBBBBBCCACCCCCCBACCBBCCCCACACBABBBBACAAAABACBCCCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACBBBBBCCACCCCCCBACCBBCCCCACACBABBBBACAAAABACBCCCBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCCABCBCCBBCBABCBBBACABBAABABBBBACCABCAAACCCCABCABCBACBAAACACACCBBABBBACAACCBCCBBCBBABCCBACCCABBBAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCACBCAAABBABCBBACAACBACACBAABBCACACBCCBBCBAAACCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCCABCBCCBBCBABCBBBACABBAABABBBBACCABCAAACCCCABCABCBACBAAACACACCBBABBBACAACCBCCBBCBBABCCBACCCABBBAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCACBCAAABBABCBBACAACBACACBAABBCACACBCCBBCBAAACCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCACCABAABBBCABCBCAAABABCCABBAACBCCBBCCBCBACCBCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCACBCAAABBABCBBACAACBACACBAABBCACACBCCBBCBAAACCACC.exe" start= auto displayName= "UserDataSvc_ABCACCABAABBBCABCBCAAABABCCABBAACBCCBBCCBCBACCBCCBA"
  2⤵
  PID:4312
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCACCABAABBBCABCBCAAABABCCABBAACBCCBBCCBCBACCBCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCACBCAAABBABCBBACAACBACACBAABBCACACBCCBBCBAAACCACC.exe" start= auto displayName= "UserDataSvc_ABCACCABAABBBCABCBCAAABABCCABBAACBCCBBCCBCBACCBCCBA"
    3⤵
    - Launches sc.exe
    PID:2104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCACCABAABBBCABCBCAAABABCCABBAACBCCBBCCBCBACCBCCBA"
  2⤵
  PID:3888
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCACCABAABBBCABCBCAAABABCCABBAACBCCBBCCBCBACCBCCBA"
    3⤵
    PID:7416

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCACBCBBCAACCBCABABAABACCABBBACACCBBACBABAAACBACCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCACBCBBCAACCBCABABAABACCABBBACACCBBACBABAAACBACCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBABBBAACABCBACACBACBBCCACCBABCCBCACABACBCBCACACCCAAACCACCCACCAABBBBACCCACBBBBCCCBCACACBBBCBBBABCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCAABBBCBABAACCBACACBCBCABBACABBCAACCBBCABBBBCBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBABBBAACABCBACACBACBBCCACCBABCCBCACABACBCBCACACCCAAACCACCCACCAABBBBACCCACBBBBCCCBCACACBBBCBBBABCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCAABBBCBABAACCBACACBCBCABBACABBCAACCBBCABBBBCBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABABABBBABABCCBABCAAABCCACACAAACBCBBCACCCCACBCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCAABBBCBABAACCBACACBCBCABBACABBCAACCBBCABBBBCBACAA.exe" start= auto displayName= "UserDataSvc_CCABABABBBABABCCBABCAAABCCACACAAACBCBBCACCCCACBCCAA"
  2⤵
  PID:7176
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:8076
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABABABBBABABCCBABCAAABCCACACAAACBCBBCACCCCACBCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCAABBBCBABAACCBACACBCBCABBACABBCAACCBBCABBBBCBACAA.exe" start= auto displayName= "UserDataSvc_CCABABABBBABABCCBABCAAABCCACACAAACBCBBCACCCCACBCCAA"
    3⤵
    PID:5860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABABABBBABABCCBABCAAABCCACACAAACBCBBCACCCCACBCCAA"
  2⤵
  PID:4592
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABABABBBABABCCBABCAAABCCACACAAACBCBBCACCCCACBCCAA"
    3⤵
    - Launches sc.exe
    PID:8188

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACACBABCCAABABACCABCABCBBBCACAAABCACABABBCCBCACAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACACBABCCAABABACCABCABCBBBCACAAABCACABABBCCBCACAAAB.exe
1⤵
- Executes dropped EXE
PID:2720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCCCCCCCCCABACAABCCAACACCCCBBCAACBAAACCABAAABCCABAABCCABAABCBBBCBBCBABACCCBCAAABCBACBBCAACABBACCCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACAABCABCBBACACBBAACCACBCBBBBCABCBAACBBBAABCBACABCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:7200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCCCCCCCCCABACAABCCAACACCCCBBCAACBAAACCABAAABCCABAABCCABAABCBBBCBBCBABACCCBCAAABCBACBBCAACABBACCCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACAABCABCBBACACBBAACCACBCBBBBCABCBAACBBBAABCBACABCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABCCCCABACAACAABACBABACCAABACBACCCABABCCBAAACBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACAABCABCBBACACBBAACCACBCBBBBCABCBAACBBBAABCBACABCCBB.exe" start= auto displayName= "UserDataSvc_ACABCCCCABACAACAABACBABACCAABACBACCCABABCCBAAACBBCA"
  2⤵
  - Executes a command shell one-liner
  PID:8236
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABCCCCABACAACAABACBABACCAABACBACCCABABCCBAAACBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACAABCABCBBACACBBAACCACBCBBBBCABCBAACBBBAABCBACABCCBB.exe" start= auto displayName= "UserDataSvc_ACABCCCCABACAACAABACBABACCAABACBACCCABABCCBAAACBBCA"
    3⤵
    - Launches sc.exe
    PID:8716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACACBABCCAABABACCABCABCBBBCACAAABCACABABBCCBCACAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACACBABCCAABABACCABCABCBBBCACAAABCACABABBCCBCACAAAB.exe
1⤵
- Executes dropped EXE
PID:5276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBCAAACBCACBCBCACACBBCBBBBABCCCBABBBACBBBCBCACBBACCBCCAAACCAAACACBCBBABABBABCBBBCACBCBBAACCCCBCACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAABBCBCCCBBCCBBABCCAABCACCACACCABCCACCBACAAABBBAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBCAAACBCACBCBCACACBBCBBBBABCCCBABBBACBBBCBCACBBACCBCCAAACCAAACACBCBBABABBABCBBBCACBCBBAACCCCBCACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAABBCBCCCBBCCBBABCCAABCACCACACCABCCACCBACAAABBBAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:7456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBCABBCCAAAAAAACCCBBBABAAABCACABCCACCCAABCBBBACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAABBCBCCCBBCCBBABCCAABCACCACACCABCCACCBACAAABBBAAAA.exe" start= auto displayName= "UserDataSvc_ACCBCABBCCAAAAAAACCCBBBABAAABCACABCCACCCAABCBBBACCC"
  2⤵
  PID:8220
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBCABBCCAAAAAAACCCBBBABAAABCACABCCACCCAABCBBBACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAABBCBCCCBBCCBBABCCAABCACCACACCABCCACCBACAAABBBAAAA.exe" start= auto displayName= "UserDataSvc_ACCBCABBCCAAAAAAACCCBBBABAAABCACABCCACCCAABCBBBACCC"
    3⤵
    - Launches sc.exe
    PID:8752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBCABBCCAAAAAAACCCBBBABAAABCACABCCACCCAABCBBBACCC"
  2⤵
  PID:8536
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBCABBCCAAAAAAACCCBBBABAAABCACABCCACCCAABCBBBACCC"
    3⤵
    - Launches sc.exe
    PID:2384

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCBBBABCAABBBAABCBABCABBAABACABACCBBACBBAAAACAAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCBBBABCAABBBAABCBABCABBAABACABACCBBACBBAAAACAAAACC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAABCCBCACBBCABBBBCBACABCCCBBABBBCBAABABCBACBCCCABABCAAABCBACCACAABAAAABBAABBABACBACBBBCCAABBCAACAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACBAAACCBCCAAACBAAABABCCBBBCCBABBCABCBBBBCCAACAAAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:7084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAABCCBCACBBCABBBBCBACABCCCBBABBBCBAABABCBACBCCCABABCAAABCBACCACAABAAAABBAABBABACBACBBBCCAABBCAACAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACBAAACCBCCAAACBAAABABCCBBBCCBABBCABCBBBBCCAACAAAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:5372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBBBABABCCBCBACCABBAAABBCCBBAACCAACABAAACCBBBBCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACBAAACCBCCAAACBAAABABCCBBBCCBABBCABCBBBBCCAACAAAABA.exe" start= auto displayName= "UserDataSvc_CBBBBABABCCBCBACCABBAAABBCCBBAACCAACABAAACCBBBBCCBB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2292
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBBBABABCCBCBACCABBAAABBCCBBAACCAACABAAACCBBBBCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACBAAACCBCCAAACBAAABABCCBBBCCBABBCABCBBBBCCAACAAAABA.exe" start= auto displayName= "UserDataSvc_CBBBBABABCCBCBACCABBAAABBCCBBAACCAACABAAACCBBBBCCBB"
    3⤵
    - Launches sc.exe
    PID:6912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBBBABABCCBCBACCABBAAABBCCBBAACCAACABAAACCBBBBCCBB"
  2⤵
  PID:6624
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBBBABABCCBCBACCABBAAABBCCBBAACCAACABAAACCBBBBCCBB"
    3⤵
    - Launches sc.exe
    PID:7088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCBBBABCAABBBAABCBABCABBAABACABACCBBACBBAAAACAAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCBBBABCAABBBAABCBABCABBAABACABACCBBACBBAAAACAAAACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCCABCABACBABCCACCCCBAAACABACAACBACCBBBCBBBCCCCBCBBBBBCCBCAACBBCAABCBABABBAABAACBBCAACCCCBABCCBACABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAACCBBBBCCCCACBBCAABCACCBBBBBBBCBCCBABBBBCCACAACBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCCABCABACBABCCACCCCBAAACABACAACBACCBBBCBBBCCCCBCBBBBBCCBCAACBBCAABCBABABBAABAACBBCAACCCCBABCCBACABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAACCBBBBCCCCACBBCAABCACCBBBBBBBCBCCBABBBBCCACAACBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:6280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAACCBCCBBBCCCBCBBBCBCABAAAAABABCBACCBBCBAABBBBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAACCBBBBCCCCACBBCAABCACCBBBBBBBCBCCBABBBBCCACAACBBBA.exe" start= auto displayName= "UserDataSvc_ABAACCBCCBBBCCCBCBBBCBCABAAAAABABCBACCBBCBAABBBBCBB"
  2⤵
  PID:5352
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAACCBCCBBBCCCBCBBBCBCABAAAAABABCBACCBBCBAABBBBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAACCBBBBCCCCACBBCAABCACCBBBBBBBCBCCBABBBBCCACAACBBBA.exe" start= auto displayName= "UserDataSvc_ABAACCBCCBBBCCCBCBBBCBCABAAAAABABCBACCBBCBAABBBBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAACCBCCBBBCCCBCBBBCBCABAAAAABABCBACCBBCBAABBBBCBB"
  2⤵
  PID:6660
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABAACCBCCBBBCCCBCBBBCBCABAAAAABABCBACCBBCBAABBBBCBB"
    3⤵
    PID:6716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBACAAACCCBCBCCBCBABCCACABABABBAACBCBACAACCBCCBACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBACAAACCCBCBCCBCBABCCACABABABBAACBCBACAACCBCCBACBAC.exe
1⤵
- Executes dropped EXE
PID:6952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCBABCCCBBCABCABBAABAAABACACBACBBABCABBCBCAABCAAACBBABABAACCABACBBABBAABCACCBBAABAAABCBBBAABAABBAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBCBABBBBBCCAAABABCCABBCBCBABAAABBBBCCCCCBCAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCBABCCCBBCABCABBAABAAABACACBACBBABCABBCBCAABCAAACBBABABAACCABACBBABBAABCACCBBAABAAABCBBBAABAABBAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBCBABBBBBCCAAABABCCABBCBCBABAAABBBBCCCCCBCAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBBABABAACACBCABBCABCAABABABCCABBCABACAACACBBCCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBCBABBBBBCCAAABABCCABBCBCBABAAABBBBCCCCCBCAABAC.exe" start= auto displayName= "UserDataSvc_ACBBABABAACACBCABBCABCAABABABCCABBCABACAACACBBCCBCC"
  2⤵
  PID:7724
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBBABABAACACBCABBCABCAABABABCCABBCABACAACACBBCCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBCBABBBBBCCAAABABCCABBCBCBABAAABBBBCCCCCBCAABAC.exe" start= auto displayName= "UserDataSvc_ACBBABABAACACBCABBCABCAABABABCCABBCABACAACACBBCCBCC"
    3⤵
    - Launches sc.exe
    PID:2584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBBABABAACACBCABBCABCAABABABCCABBCABACAACACBBCCBCC"
  2⤵
  - Executes a command shell one-liner
  PID:5516
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBBABABAACACBCABBCABCAABABABCCABBCABACAACACBBCCBCC"
    3⤵
    - Launches sc.exe
    PID:8412

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCAAABCCCAAAACCAAACACACABCABCBCACABBABBCABACCABBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCAAABCCCAAAACCAAACACACABCABCBCACABBABBCABACCABBCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBCBAAACAACCBCABBBCCACCCAAABCCCCCCCBACBBBBCBBCBCACCCBCBACCCABCAACBCCBBCBBAABCCBAAAACACBBACCACABBBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBBCCCAACCBACABBACACBCCCCCABAACBCACACBBCCCBCCABACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:7900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBCBAAACAACCBCABBBCCACCCAAABCCCCCCCBACBBBBCBBCBCACCCBCBACCCABCAACBCCBBCBBAABCCBAAAACACBBACCACABBBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBBCCCAACCBACABBACACBCCCCCABAACBCACACBBCCCBCCABACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBCACAAACBCBBCBBCABCAABABBABCBCBBBCABCBCBCAACBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBBCCCAACCBACABBACACBCCCCCABAACBCACACBBCCCBCCABACCC.exe" start= auto displayName= "UserDataSvc_ABCBCACAAACBCBBCBBCABCAABABBABCBCBBBCABCBCBCAACBBBA"
  2⤵
  - Executes a command shell one-liner
  PID:8448
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBCACAAACBCBBCBBCABCAABABBABCBCBBBCABCBCBCAACBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBBCCCAACCBACABBACACBCCCCCABAACBCACACBBCCCBCCABACCC.exe" start= auto displayName= "UserDataSvc_ABCBCACAAACBCBBCBBCABCAABABBABCBCBBBCABCBCBCAACBBBA"
    3⤵
    - Launches sc.exe
    PID:8016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBCACAAACBCBBCBBCABCAABABBABCBCBBBCABCBCBCAACBBBA"
  2⤵
  PID:8920
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBCACAAACBCBBCBBCABCAABABBABCBCBBBCABCBCBCAACBBBA"
    3⤵
    - Launches sc.exe
    PID:8540

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBACAAACCCBCBCCBCBABCCACABABABBAACBCBACAACCBCCBACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBACAAACCCBCBCCBCBABCCACABABABBAACBCBACAACCBCCBACBAC.exe
1⤵
- Executes dropped EXE
PID:6332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBCBABBABACCCABBCCBBACCAABBACBACABCBCABCBCCAAAABBACABCAACBBBBBBCCBCAABBCCCBCCACBCBBBCBCACACBCCBCAAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAAACCBAABBABBCBBBCABCCBAAACACABCBBBBBBAABABAABCBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:7984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBCBABBABACCCABBCCBBACCAABBACBACABCBCABCBCCAAAABBACABCAACBBBBBBCCBCAABBCCCBCCACBCBBBCBCACACBCCBCAAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAAACCBAABBABBCBBBCABCCBAAACACABCBBBBBBAABABAABCBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACBBCACCCCCCBBBABBABACABABABAABCAABCABBCABBBAABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAAACCBAABBABBCBBBCABCCBAAACACABCBBBBBBAABABAABCBCCB.exe" start= auto displayName= "UserDataSvc_BCACBBCACCCCCCBBBABBABACABABABAABCAABCABBCABBBAABBC"
  2⤵
  - Executes a command shell one-liner
  PID:8776
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACBBCACCCCCCBBBABBABACABABABAABCAABCABBCABBBAABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAAACCBAABBABBCBBBCABCCBAAACACABCBBBBBBAABABAABCBCCB.exe" start= auto displayName= "UserDataSvc_BCACBBCACCCCCCBBBABBABACABABABAABCAABCABBCABBBAABBC"
    3⤵
    - Launches sc.exe
    PID:3736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACBBCACCCCCCBBBABBABACABABABAABCAABCABBCABBBAABBC"
  2⤵
  - Executes a command shell one-liner
  PID:8468
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACBBCACCCCCCBBBABBABACABABABAABCAABCABBCABBBAABBC"
    3⤵
    PID:9440

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCAAABCCCAAAACCAAACACACABCABCBCACABBABBCABACCABBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCAAABCCCAAAACCAAACACACABCABCBCACABBABBCABACCABBCBA.exe
1⤵
- Executes dropped EXE
PID:6312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCCCBBCBCCABCBACAACAAAACBACAACCBCCBBBCABBCABACACABCBBACCACBBBAABAACBBABCCCABAAABAABBACCABBAABACACBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACCACCBBBCBBBBACABAACAABACAABBBCACAAABCBAAABBCCBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:7244
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCCCBBCBCCABCBACAACAAAACBACAACCBCCBBBCABBCABACACABCBBACCACBBBAABAACBBABCCCABAAABAABBACCABBAABACACBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACCACCBBBCBBBBACABAACAABACAABBBCACAAABCBAAABBCCBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACACBAAABAACABCBABACBBBABCCAAACBCCABBBCCCBBBCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACCACCBBBCBBBBACABAACAABACAABBBCACAAABCBAAABBCCBACB.exe" start= auto displayName= "UserDataSvc_BBACACBAAABAACABCBABACBBBABCCAAACBCCABBBCCCBBBCABAC"
  2⤵
  PID:8964
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBACACBAAABAACABCBABACBBBABCCAAACBCCABBBCCCBBBCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACCACCBBBCBBBBACABAACAABACAABBBCACAAABCBAAABBCCBACB.exe" start= auto displayName= "UserDataSvc_BBACACBAAABAACABCBABACBBBABCCAAACBCCABBBCCCBBBCABAC"
    3⤵
    - Launches sc.exe
    PID:5992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACACBAAABAACABCBABACBBBABCCAAACBCCABBBCCCBBBCABAC"
  2⤵
  PID:7180
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBACACBAAABAACABCBABACBBBABCCAAACBCCABBBCCCBBBCABAC"
    3⤵
    - Launches sc.exe
    PID:6104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACAACBABACCAAACBACACBAACCABACCAACCAACCACBBCCCCACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACAACBABACCAAACBACACBAACCABACCAACCAACCACBBCCCCACCBA.exe
1⤵
- Executes dropped EXE
PID:7080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABBBCCACCCBBACBCBAACBBAAACAABBACAACCCCABBCCCCBAAAABCBCBCABBBBBBCABBACCAAACCACACAABABBBAABCACABBBBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABABCCBBCBAACCCBCCACCACCACAAACACABBCACCACCBCBBCBABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABBBCCACCCBBACBCBAACBBAAACAABBACAACCCCABBCCCCBAAAABCBCBCABBBBBBCABBACCAAACCACACAABABBBAABCACABBBBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABABCCBBCBAACCCBCCACCACCACAAACACABBCACCACCBCBBCBABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCCCAAACCBCABCCCCBCBBBCCCBAACCCABAABAABCCCACBABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABABCCBBCBAACCCBCCACCACCACAAACACABBCACCACCBCBBCBABCBA.exe" start= auto displayName= "UserDataSvc_BCCCCAAACCBCABCCCCBCBBBCCCBAACCCABAABAABCCCACBABABB"
  2⤵
  PID:9612
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCCCAAACCBCABCCCCBCBBBCCCBAACCCABAABAABCCCACBABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABABCCBBCBAACCCBCCACCACCACAAACACABBCACCACCBCBBCBABCBA.exe" start= auto displayName= "UserDataSvc_BCCCCAAACCBCABCCCCBCBBBCCCBAACCCABAABAABCCCACBABABB"
    3⤵
    - Launches sc.exe
    PID:6580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCCCAAACCBCABCCCCBCBBBCCCBAACCCABAABAABCCCACBABABB"
  2⤵
  PID:9740
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCCCAAACCBCABCCCCBCBBBCCCBAACCCABAABAABCCCACBABABB"
    3⤵
    PID:8372

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACAACBABACCAAACBACACBAACCABACCAACCAACCACBBCCCCACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACAACBABACCAAACBACACBAACCABACCAACCAACCACBBCCCCACCBA.exe
1⤵
- Executes dropped EXE
PID:6340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCBACCBABCBBACBCCACCACCCACBBABCCABBCABAABBCCACBCCBACBBACAABCBBCBCAAABCACCAAABACBAABBABBCCCBBCCCCACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCBCCAAAACAACBCCBABCCCBBBCACBACAAABBABABACACAAABCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8256
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCBACCBABCBBACBCCACCACCCACBBABCCABBCABAABBCCACBCCBACBBACAABCBBCBCAAABCACCAAABACBAABBABBCCCBBCCCCACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCBCCAAAACAACBCCBABCCCBBBCACBACAAABBABABACACAAABCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:9640

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBCBCABCBBCAAAAACCBCCCCAAAAAACCACABBCBAAABBBBCAAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBCBCABCBBCAAAAACCBCCCCAAAAAACCACABBCBAAABBBBCAAAAA.exe
1⤵
- Executes dropped EXE
PID:6668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBBCBBACCBBCBBABBAAAAABCCACAABAABBBCCCBCCBAABABBAAABBCAABCACBCAACABCAABCBCBABCACCCCACBABCCBCABCCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCBACCCBAABACCCBCBABBCBCABCBACBBBACACCBAAAABACBAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:7868
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBBCBBACCBBCBBABBAAAAABCCACAABAABBBCCCBCCBAABABBAAABBCAABCACBCAACABCAABCBCBABCACCCCACBABCCBCABCCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCBACCCBAABACCCBCBABBCBCABCBACBBBACACCBAAAABACBAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBBCAABCCAABACCBBCAABCACACCABCAACBBBACACAAAAAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCBACCCBAABACCCBCBABBCBCABCBACBBBACACCBAAAABACBAACC.exe" start= auto displayName= "UserDataSvc_ABBBBCAABCCAABACCBBCAABCACACCABCAACBBBACACAAAAAAABB"
  2⤵
  PID:6504
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBBBCAABCCAABACCBBCAABCACACCABCAACBBBACACAAAAAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCBACCCBAABACCCBCBABBCBCABCBACBBBACACCBAAAABACBAACC.exe" start= auto displayName= "UserDataSvc_ABBBBCAABCCAABACCBBCAABCACACCABCAACBBBACACAAAAAAABB"
    3⤵
    - Launches sc.exe
    PID:10876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBBCAABCCAABACCBBCAABCACACCABCAACBBBACACAAAAAAABB"
  2⤵
  PID:6972

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABCACAACBAACAAABBCBBABCAAACABBBAABABAAACACBBAAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABCACAACBAACAAABBCBBABCAAACABBBAABABAAACACBBAAAABB.exe
1⤵
- Executes dropped EXE
PID:7116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAAACCAAACABCBABBACBBCBCBCCAACCCCCCCBBBABBABACABBCBBBBCCACBCBACBACBBCACBBCCCBACCAACBACCBBABACABCACBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACBABABCBBBCAABBABBCBBACAABACCABCBAABBCABCBBCCCBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:9388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAAACCAAACABCBABBACBBCBCBCCAACCCCCCCBBBABBABACABBCBBBBCCACBCBACBACBBCACBBCCCBACCAACBACCBBABACABCACBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACBABABCBBBCAABBABBCBBACAABACCABCBAABBCABCBBCCCBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBCBCAACACAAABCAACBCBBBABCCABBACABBBCBABBBCACCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACBABABCBBBCAABBABBCBBACAABACCABCBAABBCABCBBCCCBCBB.exe" start= auto displayName= "UserDataSvc_CCBBCBCAACACAAABCAACBCBBBABCCABBACABBBCBABBBCACCCCC"
  2⤵
  - Executes a command shell one-liner
  PID:10404
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBCBCAACACAAABCAACBCBBBABCCABBACABBBCBABBBCACCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACBABABCBBBCAABBABBCBBACAABACCABCBAABBCABCBBCCCBCBB.exe" start= auto displayName= "UserDataSvc_CCBBCBCAACACAAABCAACBCBBBABCCABBACABBBCBABBBCACCCCC"
    3⤵
    - Launches sc.exe
    PID:11228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBCBCAACACAAABCAACBCBBBABCCABBACABBBCBABBBCACCCCC"
  2⤵
  PID:6160

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABCACAACBAACAAABBCBBABCAAACABBBAABABAAACACBBAAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACABCACAACBAACAAABBCBBABCAAACABBBAABABAAACACBBAAAABB.exe
1⤵
- Executes dropped EXE
PID:6644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCCCACAACCACAAACBBBAACBCCCAAABACCACBCACCBABBBACBCABCBACABAAABCCACACACBCABCABBBAABBBBBACCBCBCCBBBBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCABCBABBBAABAACBCBACCBCACBCABABBBCBACCCCABCCBCCBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCCCACAACCACAAACBBBAACBCCCAAABACCACBCACCBABBBACBCABCBACABAAABCCACACACBCABCABBBAABBBBBACCBCBCCBBBBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCABCBABBBAABAACBCBACCBCACBCABABBBCBACCCCABCCBCCBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6352

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAACCBBBBCCCCACBBCAABCACCBBBBBBBCBCCBABBBBCCACAACBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAACCBBBBCCCCACBBCAABCACCBBBBBBBCBCCBABBBBCCACAACBBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACAAABBAACBCCCCCCCCBAAABACABACBAAABCBBBBAABCCCCCABCACCACBABCBCCCBAACAACCAAABBACBABAAAACBBBCCAAACBBABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABAABCACCBACABCBACBCCBCABBAACCAAAAAAACCABBBABAAABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACAAABBAACBCCCCCCCCBAAABACABACBAAABCBBBBAABCCCCCABCACCACBABCBCCCBAACAACCAAABBACBABAAAACBBBCCAAACBBABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABAABCACCBACABCBACBCCBCABBAACCAAAAAAACCABBBABAAABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:3424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAABCBACBACACABCBBABCCBCAAAACAAABBCABAABAACCACBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABAABCACCBACABCBACBCCBCABBAACCAAAAAAACCABBBABAAABCAA.exe" start= auto displayName= "UserDataSvc_AAAABCBACBACACABCBBABCCBCAAAACAAABBCABAABAACCACBACB"
  2⤵
  - Executes a command shell one-liner
  PID:10664
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAAABCBACBACACABCBBABCCBCAAAACAAABBCABAABAACCACBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABAABCACCBACABCBACBCCBCABBAACCAAAAAAACCABBBABAAABCAA.exe" start= auto displayName= "UserDataSvc_AAAABCBACBACACABCBBABCCBCAAAACAAABBCABAABAACCACBACB"
    3⤵
    - Launches sc.exe
    PID:7428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAABCBACBACACABCBBABCCBCAAAACAAABBCABAABAACCACBACB"
  2⤵
  PID:5892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAACCBBBBCCCCACBBCAABCACCBBBBBBBCBCCBABBBBCCACAACBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAACCBBBBCCCCACBBCAABCACCBBBBBBBCBCCBABBBBCCACAACBBBA.exe
1⤵
- Executes dropped EXE
PID:6620

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABBCCBACCBBCCBACABAABBBCBBCAACACAACACCBCBCCBBCCBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABBCCBACCBBCCBACABAABBBCBBCAACACAACACCBCBCCBBCCBCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBBBACBBBBABBAAAABCBBCBACACBBCBABCACACCAABABBCABBBCAACBBAABAACCBABBCABBBBACABCBABBBCBAAABABBCACBBAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCACABCACABCCCBAACBBABAAAAAABBBABBCCCBBBBABACBACBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:6560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBBBACBBBBABBAAAABCBBCBACACBBCBABCACACCAABABBCABBBCAACBBAABAACCBABBCABBBBACABCBABBBCBAAABABBCACBBAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCACABCACABCCCBAACBBABAAAAAABBBABBCCCBBBBABACBACBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCABCAAACABACCABBBBCBBBCCBBBCBBAACBCBABCABABCAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCACABCACABCCCBAACBBABAAAAAABBBABBCCCBBBBABACBACBBAA.exe" start= auto displayName= "UserDataSvc_BABCABCAAACABACCABBBBCBBBCCBBBCBBAACBCBABCABABCAACC"
  2⤵
  PID:6692
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABCABCAAACABACCABBBBCBBBCCBBBCBBAACBCBABCABABCAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCACABCACABCCCBAACBBABAAAAAABBBABBCCCBBBBABACBACBBAA.exe" start= auto displayName= "UserDataSvc_BABCABCAAACABACCABBBBCBBBCCBBBCBBAACBCBABCABABCAACC"
    3⤵
    PID:5820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABCABCAAACABACCABBBBCBBBCCBBBCBBAACBCBABCABABCAACC"
  2⤵
  PID:7464
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABCABCAAACABACCABBBBCBBBCCBBBCBBAACBCBABCABABCAACC"
    3⤵
    PID:8180

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABBCCBACCBBCCBACABAABBBCBBCAACACAACACCBCBCCBBCCBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBABBCCBACCBBCCBACABAABBBCBBCAACACAACACCBCBCCBBCCBCC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCCACBACBACCBACAAABABAACAABBABCACBACACBABBABABAAAACCAABBACCBAACACABABCBCCAACCCCCCACCACCABACABBAABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABACBABCBBBCCCBCCCBCBACABCBACAACCBCAACBCCBABABCACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:2844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCCACBACBACCBACAAABABAACAABBABCACBACACBABBABABAAAACCAABBACCBAACACABABCBCCAACCCCCCACCACCABACABBAABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABACBABCBBBCCCBCCCBCBACABCBACAACCBCAACBCCBABABCACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACCABCAAAAABBABCACBCACABAABBCAACCBCCBCAABCAACBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABACBABCBBBCCCBCCCBCBACABCBACAACCBCAACBCCBABABCACBB.exe" start= auto displayName= "UserDataSvc_BCACCABCAAAAABBABCACBCACABAABBCAACCBCCBCAABCAACBBBA"
  2⤵
  PID:4724
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACCABCAAAAABBABCACBCACABAABBCAACCBCCBCAABCAACBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABACBABCBBBCCCBCCCBCBACABCBACAACCBCAACBCCBABABCACBB.exe" start= auto displayName= "UserDataSvc_BCACCABCAAAAABBABCACBCACABAABBCAACCBCCBCAABCAACBBBA"
    3⤵
    - Launches sc.exe
    PID:7328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACCABCAAAAABBABCACBCACABAABBCAACCBCCBCAABCAACBBBA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7932
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACCABCAAAAABBABCACBCACABAABBCAACCBCCBCAABCAACBBBA"
    3⤵
    - Launches sc.exe
    PID:7296

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACBAAACCBCCAAACBAAABABCCBBBCCBABBCABCBBBBCCAACAAAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACBAAACCBCCAAACBAAABABCCBBBCCBABBCABCBBBBCCAACAAAABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:6628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBACCCBBAAAACCACCCCBABCBBCBACACCACCCABAABABAACACBABCCCACABCBCBABACCACCCCACCBBCAACAAAACBBBBBAACBCACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACACCAACCACCCCBBABBCCCCBCCCCBACABBCCCBBCABCCABBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:3944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBACCCBBAAAACCACCCCBABCBBCBACACCACCCABAABABAACACBABCCCACABCBCBABACCACCCCACCBBCAACAAAACBBBBBAACBCACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACACCAACCACCCCBBABBCCCCBCCCCBACABBCCCBBCABCCABBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACACABCCABBBCBABCABCACBBACBCBBBBCBCCBBCBABCCCBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACACCAACCACCCCBBABBCCCCBCCCCBACABBCCCBBCABCCABBCCC.exe" start= auto displayName= "UserDataSvc_BCACACABCCABBBCBABCABCACBBACBCBBBBCBCCBBCBABCCCBABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:7392
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACACABCCABBBCBABCABCACBBACBCBBBBCBCCBBCBABCCCBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACACCAACCACCCCBBABBCCCCBCCCCBACABBCCCBBCABCCABBCCC.exe" start= auto displayName= "UserDataSvc_BCACACABCCABBBCBABCABCACBBACBCBBBBCBCCBBCBABCCCBABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:8076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACACABCCABBBCBABCABCACBBACBCBBBBCBCCBBCBABCCCBABB"
  2⤵
  - Executes a command shell one-liner
  PID:5820
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACACABCCABBBCBABCABCACBBACBCBBBBCBCCBBCBABCCCBABB"
    3⤵
    PID:7204

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACBAAACCBCCAAACBAAABABCCBBBCCBABBCABCBBBBCCAACAAAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACBAAACCBCCAAACBAAABABCCBBBCCBABBCABCBBBBCCAACAAAABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:7040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACAABACBABBBAABACABCABBAABBBABBCACBAABBACCBBABCCCCAABACCCBCCBBABBCBBACAAABCBCBABCAACBCBCABAABAABAAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACBBBBBACCBBBCBABABBAAAAAAABBCCCBBABBAAACACAAACABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACAABACBABBBAABACABCABBAABBBABBCACBAABBACCBBABCCCCAABACCCBCCBBABBCBBACAAABCBCBABCAACBCBCABAABAABAAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACBBBBBACCBBBCBABABBAAAAAAABBCCCBBABBAAACACAAACABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:7428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABCCBBBCACBCACBBBCCBBAACBCABBCAABCCABCCCAAABCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACBBBBBACCBBBCBABABBAAAAAAABBCCCBBABBAAACACAAACABAA.exe" start= auto displayName= "UserDataSvc_AAABCCBBBCACBCACBBBCCBBAACBCABBCAABCCABCCCAAABCABAC"
  2⤵
  PID:8152
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABCCBBBCACBCACBBBCCBBAACBCABBCAABCCABCCCAAABCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACBBBBBACCBBBCBABABBAAAAAAABBCCCBBABBAAACACAAACABAA.exe" start= auto displayName= "UserDataSvc_AAABCCBBBCACBCACBBBCCBBAACBCABBCAABCCABCCCAAABCABAC"
    3⤵
    - Launches sc.exe
    PID:7792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABCCBBBCACBCACBBBCCBBAACBCABBCAABCCABCCCAAABCABAC"
  2⤵
  PID:7596
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABCCBBBCACBCACBBBCCBBAACBCABBCAABCCABCCCAAABCABAC"
    3⤵
    PID:7848

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCACABCACABCCCBAACBBABAAAAAABBBABBCCCBBBBABACBACBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCACABCACABCCCBAACBBABAAAAAABBBABBCCCBBBBABACBACBBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBBABABBABBBBAACABAAACAACAAACBCBACBBBBABBBAAAAACABACAABACBAABCCBCCCBCBABABBACBBABBABBBBCBCCBCCAACCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCACBAABBAABBCAABBBACAAAACBBBCABBBBCCBABBCCBACCCBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:9140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBBABABBABBBBAACABAAACAACAAACBCBACBBBBABBBAAAAACABACAABACBAABCCBCCCBCBABABBACBBABBABBBBCBCCBCCAACCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCACBAABBAABBCAABBBACAAAACBBBCABBBBCCBABBCCBACCCBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABBBCBBBCBCBBAABAACACBACACCBCBBABCBBBBCACBBCBACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCACBAABBAABBCAABBBACAAAACBBBCABBBBCCBABBCCBACCCBACB.exe" start= auto displayName= "UserDataSvc_BAABBBCBBBCBCBBAABAACACBACACCBCBBABCBBBBCACBBCBACBA"
  2⤵
  PID:7568

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCACABCACABCCCBAACBBABAAAAAABBBABBCCCBBBBABACBACBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCACABCACABCCCBAACBBABAAAAAABBBABBCCCBBBBABACBACBBAA.exe
1⤵
PID:7236

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABACBABCBBBCCCBCCCBCBACABCBACAACCBCAACBCCBABABCACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABACBABCBBBCCCBCCCBCBACABCBACAACCBCAACBCCBABABCACBB.exe
1⤵
PID:1788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCABCCCABCABACAAACAABAAAABBCABACCBCABACAABBABBCBCABBBCCAAABACBBABABACBABACBBAAACBCABCAACABBBABCAACCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAAAABAACCCAACCAACCACACABCBAABBBACABBBBCCCCCCCABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7188
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCABCCCABCABACAAACAABAAAABBCABACCBCABACAABBABBCBCABBBCCAAABACBBABABACBABACBBAAACBCABCAACABBBABCAACCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAAAABAACCCAACCAACCACACABCBAABBBACABBBBCCCCCCCABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACABABCABBABABCAAAACBCAABCCACCACCCCCAABBCCCABBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAAAABAACCCAACCAACCACACABCBAABBBACABBBBCCCCCCCABCCA.exe" start= auto displayName= "UserDataSvc_CACABABCABBABABCAAAACBCAABCCACCACCCCCAABBCCCABBBBAA"
  2⤵
  PID:9068
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACABABCABBABABCAAAACBCAABCCACCACCCCCAABBCCCABBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAAAABAACCCAACCAACCACACABCBAABBBACABBBBCCCCCCCABCCA.exe" start= auto displayName= "UserDataSvc_CACABABCABBABABCAAAACBCAABCCACCACCCCCAABBCCCABBBBAA"
    3⤵
    PID:5520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACABABCABBABABCAAAACBCAABCCACCACCCCCAABBCCCABBBBAA"
  2⤵
  PID:8424
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACABABCABBABABCAAAACBCAABCCACCACCCCCAABBCCCABBBBAA"
    3⤵
    - Launches sc.exe
    PID:9316

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABACBABCBBBCCCBCCCBCBACABCBACAACCBCAACBCCBABABCACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABACBABCBBBCCCBCCCBCBACABCBACAACCBCAACBCCBABABCACBB.exe
1⤵
PID:7328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCACBCACBBABAACBABCABCCBAAACAABBBAACCCCAACBCACBABCBBBABBCCBBCABBBACAACBAABCAACAACAAAAAACBABCAAABBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBBCACBABAACBACCCBCBBCACCCCACAAACBCCCAABAACAABACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCACBCACBBABAACBABCABCCBAAACAABBBAACCCCAACBCACBABCBBBABBCCBBCABBBACAACBAABCAACAACAAAAAACBABCAAABBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBBCACBABAACBACCCBCBBCACCCCACAAACBCCCAABAACAABACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABABBBCCACCCABAACAACABBAAACCBBCBBBABBBAAACCCBBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBBCACBABAACBACCCBCBBCACCCCACAAACBCCCAABAACAABACA.exe" start= auto displayName= "UserDataSvc_CAABABBBCCACCCABAACAACABBAAACCBBCBBBABBBAAACCCBBCAB"
  2⤵
  PID:8844
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABABBBCCACCCABAACAACABBAAACCBBCBBBABBBAAACCCBBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBBCACBABAACBACCCBCBBCACCCCACAAACBCCCAABAACAABACA.exe" start= auto displayName= "UserDataSvc_CAABABBBCCACCCABAACAACABBAAACCBBCBBBABBBAAACCCBBCAB"
    3⤵
    - Launches sc.exe
    PID:1904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABABBBCCACCCABAACAACABBAAACCBBCBBBABBBAAACCCBBCAB"
  2⤵
  PID:8912
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABABBBCCACCCABAACAACABBAAACCBBCBBBABBBAAACCCBBCAB"
    3⤵
    - Launches sc.exe
    PID:9996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACACCAACCACCCCBBABBCCCCBCCCCBACABBCCCBBCABCCABBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACACCAACCACCCCBBABBCCCCBCCCCBACABBCCCBBCABCCABBCCC.exe
1⤵
PID:7512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCACBABABBCCBABABACBACBBCCCBBABCBBBBCABBCABBABABCBACABCCACCCACCAAAAABCBBCABCACACABCBAAACAABCBCCCAAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABABCBABAAAABACBCBABBACCBBCCBBBABBCAACCCCCCBBCBBBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCACBABABBCCBABABACBACBBCCCBBABCBBBBCABBCABBABABCBACABCCACCCACCAAAAABCBBCABCACACABCBAAACAABCBCCCAAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABABCBABAAAABACBCBABBACCBBCCBBBABBCAACCCCCCBBCBBBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBABCCCACBBBBABAACCCAABCBACCBACBBCBAABBACCCABCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABABCBABAAAABACBCBABBACCBBCCBBBABBCAACCCCCCBBCBBBBBB.exe" start= auto displayName= "UserDataSvc_ACCBABCCCACBBBBABAACCCAABCBACCBACBBCBAABBACCCABCBBB"
  2⤵
  - Executes a command shell one-liner
  PID:8492
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBABCCCACBBBBABAACCCAABCBACCBACBBCBAABBACCCABCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABABCBABAAAABACBCBABBACCBBCCBBBABBCAACCCCCCBBCBBBBBB.exe" start= auto displayName= "UserDataSvc_ACCBABCCCACBBBBABAACCCAABCBACCBACBBCBAABBACCCABCBBB"
    3⤵
    PID:9520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBABCCCACBBBBABAACCCAABCBACCBACBBCBAABBACCCABCBBB"
  2⤵
  - Executes a command shell one-liner
  PID:10208
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBABCCCACBBBBABAACCCAABCBACCBACBBCBAABBACCCABCBBB"
    3⤵
    - Launches sc.exe
    PID:6748

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACBBBBBACCBBBCBABABBAAAAAAABBCCCBBABBAAACACAAACABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACBBBBBACCBBBCBABABBAAAAAAABBCCCBBABBAAACACAAACABAA.exe
1⤵
PID:7620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCACCABCABABACBBCABCBCABBCCCABCACBABABBCAABACBBACBAABCBCAABAAACABBABCCBCCACACBAACCCABCCABAABABCABCABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCACCCBCAACABACACCAABBABCAABAAACABCACAACCCAABACCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCACCABCABABACBBCABCBCABBCCCABCACBABABBCAABACBBACBAABCBCAABAAACABBABCCBCCACACBAACCCABCCABAABABCABCABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCACCCBCAACABACACCAABBABCAABAAACABCACAACCCAABACCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBABCCCACBBBBABAACCCAABCBACCBACBBCBAABBACCCABCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCACCCBCAACABACACCAABBABCAABAAACABCACAACCCAABACCAA.exe" start= auto displayName= "UserDataSvc_ACCBABCCCACBBBBABAACCCAABCBACCBACBBCBAABBACCCABCBBB"
  2⤵
  - Executes a command shell one-liner
  PID:2976
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBABCCCACBBBBABAACCCAABCBACCBACBBCBAABBACCCABCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCACCCBCAACABACACCAABBABCAABAAACABCACAACCCAABACCAA.exe" start= auto displayName= "UserDataSvc_ACCBABCCCACBBBBABAACCCAABCBACCBACBBCBAABBACCCABCBBB"
    3⤵
    - Launches sc.exe
    PID:9960

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCAAABBCCBAACBBBAABBBCACBCBAABBBBBCCBCBAABBCCACABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCAAABBCCBAACBBBAABBBCACBCBAABBBBBCCBCBAABBCCACABCCA.exe
1⤵
PID:8148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCABBACABACCABCCCBBACBCCCBACABAACCABCAACACBCCAAABABBACAAACBBBACBBAACBCACABABBBCBABCACBBAABCCCCACACCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCABCBCCBCBBACCACCCCBACCCCBCBBBBAACABCCBBBBCAABAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCABBACABACCABCCCBBACBCCCBACABAACCABCAACACBCCAAABABBACAAACBBBACBBAACBCACABABBBCBABCACBBAABCCCCACACCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCABCBCCBCBBACCACCCCBACCCCBCBBBBAACABCCBBBBCAABAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBACCCCACAACCBBCBACACCCAACBCBBBBBABBBCCAABCABAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCABCBCCBCBBACCACCCCBACCCCBCBBBBAACABCCBBBBCAABAAAAA.exe" start= auto displayName= "UserDataSvc_BCBBACCCCACAACCBBCBACACCCAACBCBBBBBABBBCCAABCABAAAA"
  2⤵
  - Executes a command shell one-liner
  PID:9372
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBACCCCACAACCBBCBACACCCAACBCBBBBBABBBCCAABCABAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCABCBCCBCBBACCACCCCBACCCCBCBBBBAACABCCBBBBCAABAAAAA.exe" start= auto displayName= "UserDataSvc_BCBBACCCCACAACCBBCBACACCCAACBCBBBBBABBBCCAABCABAAAA"
    3⤵
    PID:10776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBACCCCACAACCBBCBACACCCAACBCBBBBBABBBCCAABCABAAAA"
  2⤵
  PID:8288

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACACCAACCACCCCBBABBCCCCBCCCCBACABBCCCBBCABCCABBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACACCAACCACCCCBBABBCCCCBCCCCBACABBCCCBBCABCCABBCCC.exe
1⤵
PID:7484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCABACABAAACCCABACABACBCCBBBBCAABAABABCACBCAACACBBCBBBCCCBBBACBBCCAAAACBCBAAACACCCCCCBCCABACAABABBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBABCCCAABABBCCBCCCACBBBCABABCCCBAACCCAACAAABBACBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCABACABAAACCCABACABACBCCBBBBCAABAABABCACBCAACACBBCBBBCCCBBBACBBCCAAAACBCBAAACACCCCCCBCCABACAABABBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBABCCCAABABBCCBCCCACBBBCABABCCCBAACCCAACAAABBACBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCAAAAABCCCCBBBCACBCBAABABCABCCBBBCCBCACAACBCBCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBABCCCAABABBCCBCCCACBBBCABABCCCBAACCCAACAAABBACBAAB.exe" start= auto displayName= "UserDataSvc_BCCAAAAABCCCCBBBCACBCBAABABCABCCBBBCCBCACAACBCBCAAC"
  2⤵
  - Executes a command shell one-liner
  PID:8460
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCAAAAABCCCCBBBCACBCBAABABCABCCBBBCCBCACAACBCBCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBABCCCAABABBCCBCCCACBBBCABABCCCBAACCCAACAAABBACBAAB.exe" start= auto displayName= "UserDataSvc_BCCAAAAABCCCCBBBCACBCBAABABCABCCBBBCCBCACAACBCBCAAC"
    3⤵
    PID:10372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCAAAAABCCCCBBBCACBCBAABABCABCCBBBCCBCACAACBCBCAAC"
  2⤵
  - Executes a command shell one-liner
  PID:10040
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCAAAAABCCCCBBBCACBCBAABABCABCCBBBCCBCACAACBCBCAAC"
    3⤵
    PID:9776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAABACCACCACACAABBAAAABBCBABCCAABBBAABBBCAABBAABCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAABACCACCACACAABBAAAABBCBABCCAABBBAABBBCAABBAABCBC.exe
1⤵
PID:624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBCBAAABBABCBCABBCABAABBBABCBCCBCCBBBAACCACBBACCBABCBABBCBAABAACBABBBBBABCAAABBBABCBBBBCCCBACACCBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBCCBCBBCCCABCCACAAAAACACBBCBACACCCCCBAABCCCCBBCCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBCBAAABBABCBCABBCABAABBBABCBCCBCCBBBAACCACBBACCBABCBABBCBAABAACBABBBBBABCAAABBBABCBBBBCCCBACACCBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBCCBCBBCCCABCCACAAAAACACBBCBACACCCCCBAABCCCCBBCCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBAACACBBAABACBABCBCBACACAABABBACBBACCBABCAACAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBCCBCBBCCCABCCACAAAAACACBBCBACACCCCCBAABCCCCBBCCACB.exe" start= auto displayName= "UserDataSvc_BACBAACACBBAABACBABCBCBACACAABABBACBBACCBABCAACAAAA"
  2⤵
  PID:7656
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBAACACBBAABACBABCBCBACACAABABBACBBACCBABCAACAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBCCBCBBCCCABCCACAAAAACACBBCBACACCCCCBAABCCCCBBCCACB.exe" start= auto displayName= "UserDataSvc_BACBAACACBBAABACBABCBCBACACAABABBACBBACCBABCAACAAAA"
    3⤵
    PID:9832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBAACACBBAABACBABCBCBACACAABABBACBBACCBABCAACAAAA"
  2⤵
  PID:9112
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBAACACBBAABACBABCBCBACACAABABBACBBACCBABCAACAAAA"
    3⤵
    PID:10360

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAABACCACCACACAABBAAAABBCBABCCAABBBAABBBCAABBAABCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAABACCACCACACAABBAAAABBCBABCCAABBBAABBBCAABBAABCBC.exe
1⤵
PID:5548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCABBBCCAACCBAABBABBCCABBCABBACAACABBCBAAAABBABCCCCACACACCCCCCCAABCAAAACBBBBABCBBCCCCCBACACBCCACBAABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAAACCABBABCCCBBCBBCBACCAABABCACCCBCAABACABCACACBBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCABBBCCAACCBAABBABBCCABBCABBACAACABBCBAAAABBABCCCCACACACCCCCCCAABCAAAACBBBBABCBBCCCCCBACACBCCACBAABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAAACCABBABCCCBBCBBCBACCAABABCACCCBCAABACABCACACBBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABBBACABBCACABBACBCAAACCCABBABCCBBCBABCACAACCBBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAAACCABBABCCCBBCBBCBACCAABABCACCCBCAABACABCACACBBCCC.exe" start= auto displayName= "UserDataSvc_BABBBACABBCACABBACBCAAACCCABBABCCBBCBABCACAACCBBCBA"
  2⤵
  PID:10136
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABBBACABBCACABBACBCAAACCCABBABCCBBCBABCACAACCBBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAAACCABBABCCCBBCBBCBACCAABABCACCCBCAABACABCACACBBCCC.exe" start= auto displayName= "UserDataSvc_BABBBACABBCACABBACBCAAACCCABBABCCBBCBABCACAACCBBCBA"
    3⤵
    - Launches sc.exe
    PID:6436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABBBACABBCACABBACBCAAACCCABBABCCBBCBABCACAACCBBCBA"
  2⤵
  - Executes a command shell one-liner
  PID:10364
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABBBACABBCACABBACBCAAACCCABBABCCBBCBABCACAACCBBCBA"
    3⤵
    - Launches sc.exe
    PID:9084

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCACBCAAABBABCBBACAACBACACBAABBCACACBCCBBCBAAACCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCACBCAAABBABCBBACAACBACACBAABBCACACBCCBBCBAAACCACC.exe
1⤵
PID:3676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACBACACCCAACAACBBABBBABBCBAACAABCCCBAABBBABCABACCBCCBABAAABBABACAAACBCAABCACCBCACBBABCCACAACCAABCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCABBBBCACBBAAAABCABCCBBBAABCCABCBABCBBCABCCCCAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACBACACCCAACAACBBABBBABBCBAACAABCCCBAABBBABCABACCBCCBABAAABBABACAAACBCAABCACCBCACBBABCCACAACCAABCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCABBBBCACBBAAAABCABCCBBBAABCCABCBABCBBCABCCCCAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCAABABCABCAAABCCABCCABABACCBBBCCACAABBABCBCAABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCABBBBCACBBAAAABCABCCBBBAABCCABCBABCBBCABCCCCAAAAB.exe" start= auto displayName= "UserDataSvc_BCCAABABCABCAAABCCABCCABABACCBBBCCACAABBABCBCAABCCC"
  2⤵
  PID:9644
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCAABABCABCAAABCCABCCABABACCBBBCCACAABBABCBCAABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCABBBBCACBBAAAABCABCCBBBAABCCABCBABCBBCABCCCCAAAAB.exe" start= auto displayName= "UserDataSvc_BCCAABABCABCAAABCCABCCABABACCBBBCCACAABBABCBCAABCCC"
    3⤵
    - Launches sc.exe
    PID:10792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCAABABCABCAAABCCABCCABABACCBBBCCACAABBABCBCAABCCC"
  2⤵
  - Executes a command shell one-liner
  PID:6720
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCAABABCABCAAABCCABCCABABACCBBBCCACAABBABCBCAABCCC"
    3⤵
    - Launches sc.exe
    PID:1132

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACBBBBBACCBBBCBABABBAAAAAAABBCCCBBABBAAACACAAACABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACBBBBBACCBBBCBABABBAAAAAAABBCCCBBABBAAACACAAACABAA.exe
1⤵
PID:4696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCCBCAAACCCAABBBACACBAAABABCACBCAAAAABCCABAAACABBCBBABABBCACAAAACCACCCBCACBBCBACAABCCCACCCCBBCBBCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCBACCBCCCBCCAACBCCCCCAABBACBACCBBABBCBABABCCABBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:9536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCCBCAAACCCAABBBACACBAAABABCACBCAAAAABCCABAAACABBCBBABABBCACAAAACCACCCBCACBBCBACAABCCCACCCCBBCBBCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCBACCBCCCBCCAACBCCCCCAABBACBACCBBABBCBABABCCABBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCCBACBACCCACBBBCBABBABABBABABBBBCCCACCCCCAABCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCBACCBCCCBCCAACBCCCCCAABBACBACCBBABBCBABABCCABBBC.exe" start= auto displayName= "UserDataSvc_CBBCCBACBACCCACBBBCBABBABABBABABBBBCCCACCCCCAABCCBA"
  2⤵
  PID:9904
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCCBACBACCCACBBBCBABBABABBABABBBBCCCACCCCCAABCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCBACCBCCCBCCAACBCCCCCAABBACBACCBBABBCBABABCCABBBC.exe" start= auto displayName= "UserDataSvc_CBBCCBACBACCCACBBBCBABBABABBABABBBBCCCACCCCCAABCCBA"
    3⤵
    - Launches sc.exe
    PID:11092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCAABBBCBABAACCBACACBCBCABBACABBCAACCBBCABBBBCBACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCAABBBCBABAACCBACACBCBCABBACABBCAACCBBCABBBBCBACAA.exe
1⤵
PID:5508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCAABCACBCABCACACAABACCCABBCAAAABABABBBBABBBCAACCBCBACCACBCCCACBBCABACABABAAACCBCBACCBCBBACBABCBCCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCABCBBCCBBABCBACCACCCBBAAABCCCBBBCBCABABAACAAABBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCAABCACBCABCACACAABACCCABBCAAAABABABBBBABBBCAACCBCBACCACBCCCACBBCABACABABAAACCBCBACCBCBBACBABCBCCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCABCBBCCBBABCBACCACCCBBAAABCCCBBBCBCABABAACAAABBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACACABBABCBCBBABAAACCAABCCBCBACAABBCCACABCBBBBCCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCABCBBCCBBABCBACCACCCBBAAABCCCBBBCBCABABAACAAABBBB.exe" start= auto displayName= "UserDataSvc_ACACABBABCBCBBABAAACCAABCCBCBACAABBCCACABCBBBBCCCCC"
  2⤵
  - Executes a command shell one-liner
  PID:7416

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBCBABBBBBCCAAABABCCABBCBCBABAAABBBBCCCCCBCAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBCBABBBBBCCAAABABCCABBCBCBABAAABBBBCCCCCBCAABAC.exe
1⤵
PID:5296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBBABABBABBBBAACABAAACAACAAACBCBACBBBBABBBAAAAACABACAABACBAABCCBCCCBCBABABBACBBABBABBBBCBCCBCCAACCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAAACCBCABCCCCBCBBBCCCBAACCCABAABAABCCCACBABABBAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBBABABBABBBBAACABAAACAACAAACBCBACBBBBABBBAAAAACABACAABACBAABCCBCCCBCBABABBACBBABBABBBBCBCCBCCAACCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAAACCBCABCCCCBCBBBCCCBAACCCABAABAABCCCACBABABBAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6368

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCAABBBCBABAACCBACACBCBCABBACABBCAACCBBCABBBBCBACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCAABBBCBABAACCBACACBCBCABBACABBCAACCBBCABBBBCBACAA.exe
1⤵
PID:4244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACBCBAACBBACBBAAAAACCAACBCACACABACAAAACCCACCCCCCBAAAABCABABACBACCACCACBBBBAABBABBCBCACACCBCABBBACBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCBBCCBAACAABBCAACBCCBAABCCCBCACCCCBCACACBCABBAACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACBCBAACBBACBBAAAAACCAACBCACACABACAAAACCCACCCCCCBAAAABCABABACBACCACCACBBBBAABBABBCBCACACCBCABBBACBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABCBBCCBAACAABBCAACBCCBAABCCCBCACCCCBCACACBCABBAACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11044

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCACBCAAABBABCBBACAACBACACBAABBCACACBCCBBCBAAACCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCACBCAAABBABCBBACAACBACACBAABBCACACBCCBBCBAAACCACC.exe
1⤵
PID:2668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBAACBCCABCCACABAAACACCCCCCCCBCAABACABBCCBAABCABACBCCABAAAAAACCCCACCAACAACBCBACBBACACAACCBAABCCBCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABCCBACCABABAAABCCCBCBCBAACBBCAACACBCBACBAAAAABBCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBAACBCCABCCACABAAACACCCCCCCCBCAABACABBCCBAABCABACBCCABAAAAAACCCCACCAACAACBCBACBBACACAACCBAABCCBCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABCCBACCABABAAABCCCBCBCBAACBBCAACACBCBACBAAAAABBCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:11256

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBCBABBBBBCCAAABABCCABBCBCBABAAABBBBCCCCCBCAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBCBABBBBBCCAAABABCCABBCBCBABAAABBBBCCCCCBCAABAC.exe
1⤵
PID:8484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBCCBBBBAACBCAAACACAABCBBABABCCABAAACACCCCCABABABCBACABCACABACBCCBBAABCBBACABCACCACCAACACBABCACBBAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBCCBBBBAACBCAAACACAABCBBABABCCABAAACACCCCCABABABCBACABCACABACBCCBBAABCBBACABCACCACCAACACBABCACBBAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACABABACCACCAAAABCABBCAABBACBACCBAAACAACBBBBBBBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBBCCCAACCBACABBACACBCCCCCABAACBCACACBBCCCBCCABACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBBCCCAACCBACABBACACBCCCCCABAACBCACACBBCCCBCCABACCC.exe
1⤵
PID:8512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCCBBBCCBBCAAACAAAABCCAABACBAACBBCABAACABBBACAAABCCCAACCAACBCBAACCCBABBABCCBBBAACCBACABCCBBCBABAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABCBACBACACABCBBABCCBCAAAACAAABBCABAABAACCACBACBACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCCBBBCCBBCAAACAAAABCCAABACBAACBBCABAACABBBACAAABCCCAACCAACBCBAACCCBABBABCCBBBAACCBACABCCBBCBABAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABCBACBACACABCBBABCCBCAAAACAAABBCABAABAACCACBACBACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7236

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAABBCBCCCBBCCBBABCCAABCACCACACCABCCACCBACAAABBBAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAABBCBCCCBBCCBBABCCAABCACCACACCABCCACCBACAAABBBAAAA.exe
1⤵
PID:8696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBAACABACBABCBBAACCBABBBAACABACCBBBAAACBABCACCAACBBCBABAABAACCCCAACCCABABBCCCBACBABBBABBAABCABACCCCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCBAAACABCAAABBCCBBACBBACACCCABABACCABBACAABACBBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBAACABACBABCBBAACCBABBBAACABACCBBBAAACBABCACCAACBBCBABAABAACCCCAACCCABABBCCCBACBABBBABBAABCABACCCCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCBAAACABCAAABBCCBBACBBACACCCABABACCABBACAABACBBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4732

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACAABCABCBBACACBBAACCACBCBBBBCABCBAACBBBAABCBACABCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACAABCABCBBACACBBAACCACBCBBBBCABCBAACBBBAABCBACABCCBB.exe
1⤵
PID:1276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCACBBCBBCBCBAABCCCCCAABCCBAAABBBAACACBBAAACAACCBCCCBACACBCACBCACCCBCABCBAACBBCAAACBAACBBBBBBABCBBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBAACBBBAABACBACBCCBABBABBAAACBABBCBCBAABBBCABACBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCACBBCBBCBCBAABCCCCCAABCCBAAABBBAACACBBAAACAACCBCCCBACACBCACBCACCCBCABCBAACBBCAAACBAACBBBBBBABCBBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBAACBBBAABACBACBCCBABBABBAAACBABBCBCBAABBBCABACBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACBABACBBCABAACCACABCBBCCCABCACAACABABCCCBABAAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBAACBBBAABACBACBCCBABBABBAAACBABBCBCBAABBBCABACBAB.exe" start= auto displayName= "UserDataSvc_CBACBABACBBCABAACCACABCBBCCCABCACAACABABCCCBABAAAAA"
  2⤵
  PID:10808
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACBABACBBCABAACCACABCBBCCCABCACAACABABCCCBABAAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBAACBBBAABACBACBCCBABBABBAAACBABBCBCBAABBBCABACBAB.exe" start= auto displayName= "UserDataSvc_CBACBABACBBCABAACCACABCBBCCCABCACAACABABCCCBABAAAAA"
    3⤵
    - Launches sc.exe
    PID:6232

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBBCACBABAACBACCCBCBBCACCCCACAAACBCCCAABAACAABACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBBCACBABAACBACCCBCBBCACCCCACAAACBCCCAABAACAABACA.exe
1⤵
PID:8816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABACCBCBCBCBABBBCBCABBCCAAABACBBCBBAAAABCCCCACACCBBCAAAABABAACBCBAAAAABACABBCAABABCABACBCAAAAACAABBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCCBCCCCAAAACBBABCBCACCBACACCCBABACCACCABACAAAAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:9492
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABACCBCBCBCBABBBCBCABBCCAAABACBBCBBAAAABCCCCACACCBBCAAAABABAACBCBAAAAABACABBCAABABCABACBCAAAAACAABBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCCBCCCCAAAACBBABCBCACCBACACCCBABACCACCABACAAAAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABACBBCBBBBCCAABCCBBAACBABCCBBBABAABACBCBCBACBCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCCBCCCCAAAACBBABCBCACCBACACCCBABACCACCABACAAAAACAA.exe" start= auto displayName= "UserDataSvc_CABACBBCBBBBCCAABCCBBAACBABCCBBBABAABACBCBCBACBCBAA"
  2⤵
  PID:5056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAAACCBAABBABBCBBBCABCCBAAACACABCBBBBBBAABABAABCBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAAACCBAABBABBCBBBCABCCBAAACACABCBBBBBBAABABAABCBCCB.exe
1⤵
PID:9120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBAACAACCAABCAABACCBACAACCBCCBCCBCACBBBBACCBBCAACCCBAACCBCBCACACCCACBCCCBACBBBAAACAACAAAAAABCACBCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABCABAACABACBABACBCACCCBABAABBBBBBCAAAACACCCCBAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3316
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBAACAACCAABCAABACCBACAACCBCCBCCBCACBBBBACCBBCAACCCBAACCBCBCACACCCACBCCCBACBBBAAACAACAAAAAABCACBCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABCABAACABACBABACBCACCCBABAABBBBBBCAAAACACCCCBAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBCBAACCACAAAACBBAAABAAAABCBACBBCCBCBCBCCCACABAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABCABAACABACBABACBCACCCBABAABBBBBBCAAAACACCCCBAABAB.exe" start= auto displayName= "UserDataSvc_ABBCBAACCACAAAACBBAAABAAAABCBACBBCCBCBCBCCCACABAACA"
  2⤵
  PID:8416

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAAAABAACCCAACCAACCACACABCBAABBBACABBBBCCCCCCCABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAAAABAACCCAACCAACCACACABCBAABBBACABBBBCCCCCCCABCCA.exe
1⤵
PID:628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACABBABAACBCBCCBCACCCBCAAACCACBCBCCBBBCBBABBCBCACACABABCBABBAACBCABCBABBBCBBCCABAACACABBACBABACACBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACBCAACCACBCCBBBACCCCBCABCACABAABCBABBBBBCCBAAABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:6372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACABBABAACBCBCCBCACCCBCAAACCACBCBCCBBBCBBABBCBCACACABABCBABBAACBCABCBABBBCBBCCABAACACABBACBABACACBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACBCAACCACBCCBBBACCCCBCABCACABAABCBABBBBBCCBAAABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACACAABBACCCBBACCABCCAABCBCCAAAAACBCABCBBCCBACAABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACBCAACCACBCCBBBACCCCBCABCACABAABCBABBBBBCCBAAABACB.exe" start= auto displayName= "UserDataSvc_ACACAABBACCCBBACCABCCAABCBCCAAAAACBCABCBBCCBACAABCB"
  2⤵
  PID:4108

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBBCCCAACCBACABBACACBCCCCCABAACBCACACBBCCCBCCABACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBBCCCAACCBACABBACACBCCCCCABAACBCACACBBCCCBCCABACCC.exe
1⤵
PID:5520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAAABBBCCABCCCBBABABCCABCBCABBBCCACBACBCBABCCBCCBAACCAACABCBBAAABBACCAABBCBAAACBABABACCBACABCCBCBCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABCBCACACAAABAABBABBCCCACAAABBBCCBBCBBBCACACCBCBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAAABBBCCABCCCBBABABCCABCBCABBBCCACBACBCBABCCBCCBAACCAACABCBBAAABBACCAABBCBAAACBABABACCBACABCCBCBCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABCBCACACAAABAABBABBCCCACAAABBBCCBBCBBBCACACCBCBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABBCCABACBCBACABCBCBABBAACAACCABCBCABBBBCCACABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABCBCACACAAABAABBABBCCCACAAABBBCCBBCBBBCACACCBCBAAA.exe" start= auto displayName= "UserDataSvc_BAABBCCABACBCBACABCBCBABBAACAACCABCBCABBBBCCACABBBC"
  2⤵
  PID:8024
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABBCCABACBCBACABCBCBABBAACAACCABCBCABBBBCCACABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABCBCACACAAABAABBABBCCCACAAABBBCCBBCBBBCACACCBCBAAA.exe" start= auto displayName= "UserDataSvc_BAABBCCABACBCBACABCBCBABBAACAACCABCBCABBBBCCACABBBC"
    3⤵
    - Launches sc.exe
    PID:10860

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAABBCBCCCBBCCBBABCCAABCACCACACCABCCACCBACAAABBBAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCAABBCBCCCBBCCBBABCCAABCACCACACCABCCACCBACAAABBBAAAA.exe
1⤵
PID:5792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAAABBBCCABCCCBBABABCCABCBCABBBCCACBACBCBABCCBCCBAACCAACABCBBAAABBACCAABBCBAAACBABABACCBACABCCBCBCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAAAACAAABCCCBAABCBCABAABBAABACBABBACBBABAAABABBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAAABBBCCABCCCBBABABCCABCBCABBBCCACBACBCBABCCBCCBAACCAACABCBBAAABBACCAABBCBAAACBABABACCBACABCCBCBCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAAAACAAABCCCBAABCBCABAABBAABACBABBACBBABAAABABBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABBCBBBAAABBBACACCBBCCACCACAAACABCBBABCCAAACCCCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAAAACAAABCCCBAABCBCABAABBAABACBABBACBBABAAABABBAAA.exe" start= auto displayName= "UserDataSvc_BABBCBBBAAABBBACACCBBCCACCACAAACABCBBABCCAAACCCCABA"
  2⤵
  PID:10900
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABBCBBBAAABBBACACCBBCCACCACAAACABCBBABCCAAACCCCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAAAACAAABCCCBAABCBCABAABBAABACBABBACBBABAAABABBAAA.exe" start= auto displayName= "UserDataSvc_BABBCBBBAAABBBACACCBBCCACCACAAACABCBBABCCAAACCCCABA"
    3⤵
    - Launches sc.exe
    PID:3416

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACCACCBBBCBBBBACABAACAABACAABBBCACAAABCBAAABBCCBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACCACCBBBCBBBBACABAACAABACAABBBCACAAABCBAAABBCCBACB.exe
1⤵
PID:2916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCAACCBCCBBCBBCBCCBACCBCACACBBBBABCBBCBBCBCAACACACBACBCCAACABABBAABABCCAACBCBBCBABBBBACBCBABABCCCCCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAAAACAAABCCCBAABCBCABAABBAABACBABBACBBABAAABABBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCAACCBCCBBCBBCBCCBACCBCACACBBBBABCBBCBBCBCAACACACBACBCCAACABABBAABABCCAACBCBBCBABBBBACBCBABABCCCCCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAAAACAAABCCCBAABCBCABAABBAABACBABBACBBABAAABABBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAACACBABAACCCABABABAAAACAACAABBCCBCCCCBACBACAACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAAAACAAABCCCBAABCBCABAABBAABACBABBACBBABAAABABBAAA.exe" start= auto displayName= "UserDataSvc_BAAACACBABAACCCABABABAAAACAACAABBCCBCCCCBACBACAACBC"
  2⤵
  PID:5104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBCCBCBBCCCABCCACAAAAACACBBCBACACCCCCBAABCCCCBBCCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBCCBCBBCCCABCCACAAAAACACBBCBACACCCCCBAABCCCCBBCCACB.exe
1⤵
PID:8572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBCCCBACACBBBABACCAABCCACACBACBBCAACAABBBAACBCCAAABBBCCAABBABCCACCCBABCCCCABCCBABACBBABBAACAAABABCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCCCAAACCCCABACBCBABABBBBAACBBABCCCCBACACACCACBBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBCCCBACACBBBABACCAABCCACACBACBBCAACAABBBAACBCCAAABBBCCAABBABCCACCCBABCCCCABCCBABACBBABBAACAAABABCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCCCAAACCCCABACBCBABABBBBAACBBABCCCCBACACACCACBBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2572

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACCACCBBBCBBBBACABAACAABACAABBBCACAAABCBAAABBCCBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACCACCBBBCBBBBACABAACAABACAABBBCACAAABCBAAABBCCBACB.exe
1⤵
PID:404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACBBBBABBCACCAAAABABBABABBCBABBCBAAABBBCCACBCCAACACBABBBABCBBCABCACABCBCACAACCCCBAABCACABBCBCCAABBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAABCBCABAABACACACCCABBABCABCCCBCCCBBBAACCACBCBAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:11200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACBBBBABBCACCAAAABABBABABBCBABBCBAAABBBCCACBCCAACACBABBBABCBBCABCACABCBCACAACCCCBAABCACABBCBCCAABBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAABCBCABAABACACACCCABBABCABCCCBCCCBBBAACCACBCBAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10304

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAAAABAACCCAACCAACCACACABCBAABBBACABBBBCCCCCCCABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAAAABAACCCAACCAACCACACABCBAABBBACABBBBCCCCCCCABCCA.exe
1⤵
PID:9572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBAACABBAACBCBBBAACCCCCCAACACABAACBBACBBCBBBCACABCCBBAABACBAACAAAAABCCAAAAABBBBABABBCACBCAABBACCBCAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBCCCCCBCABABCACCCCBACBAABBCCBBACCCBBBACACAAAACACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8548

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABABCBABAAAABACBCBABBACCBBCCBBBABBCAACCCCCCBBCBBBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABABCBABAAAABACBCBABBACCBBCCBBBABBCAACCCCCCBBCBBBBBB.exe
1⤵
PID:9580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCAAACABBBACCBCBBACCAACCBABCCACCABAACCBAABBCAACBCBBACBBCBACBCACBBCACACBAAAACAACBCCCBBABBCBABBAAABCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBAABCACBAABCBBABBCBBAABCBCCACAABABCCCCCCCABBCBAAACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:7588

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAAACCBAABBABBCBBBCABCCBAAACACABCBBBBBBAABABAABCBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAAACCBAABBABBCBBBCABCCBAAACACABCBBBBBBAABABAABCBCCB.exe
1⤵
PID:9848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAABCCCCACACBCABBCCCCCBBBBCBBBCCCBAABBBAABAABBCACCBCBABBCCABBCACBCABABCACCACCCCCBCCCBBABBCAAABCABCABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABABCACBACCACCBCBCACAABBBABABCCBBCCBAABACBCCBAAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11248

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBBCACBABAACBACCCBCBBCACCCCACAAACBCCCAABAACAABACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBBCACBABAACBACCCBCBBCACCCCACAAACBCCCAABAACAABACA.exe
1⤵
PID:10188

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCACCCBCAACABACACCAABBABCAABAAACABCACAACCCAABACCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCACCCBCAACABACACCAABBABCAABAAACABCACAACCCAABACCAA.exe
1⤵
PID:236

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABABCBABAAAABACBCBABBACCBBCCBBBABBCAACCCCCCBBCBBBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABABCBABAAAABACBCBABBACCBBCCBBBABBCAACCCCCCBBCBBBBBB.exe
1⤵
PID:10528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBCCBCBBCCCABCCACAAAAACACBBCBACACCCCCBAABCCCCBBCCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBCCBCBBCCCABCCACAAAAACACBBCBACACCCCCBAABCCCCBBCCACB.exe
1⤵
PID:10648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACCBBCACBBABCAACACCABCCACBBBCACBACBBCCACABCAACCABABCBBAAAACACABBBCABAACCAABCCABBCBBABCBBBAACBABBAACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBBBBBABCBABBCCCBCAABAABABAAACBBAAABBCBCBBACCBCBBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:9896

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCABCBCCBCBBACCACCCCBACCCCBCBBBBAACABCCBBBBCAABAAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCABCBCCBCBBACCACCCCBACCCCBCBBBBAACABCCBBBBCAABAAAAA.exe
1⤵
PID:5140

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCBACCCBAABACCCBCBABBCBCABCBACBBBACACCBAAAABACBAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCBACCCBAABACCCBCBABBCBCABCBACBBBACACCBAAAABACBAACC.exe
1⤵
PID:8280

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAAACCABBABCCCBBCBBCBACCAABABCACCCBCAABACABCACACBBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAAACCABBABCCCBBCBBCBACCAABABCACCCBCAABACABCACACBBCCC.exe
1⤵
PID:7044

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAAACCABBABCCCBBCBBCBACCAABABCACCCBCAABACABCACACBBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAAACCABBABCCCBBCBBCBACCAABABCACCCBCAABACABCACACBBCCC.exe
1⤵
PID:6476

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABABCCBBCBAACCCBCCACCACCACAAACACABBCACCACCBCBBCBABCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABABCCBBCBAACCCBCCACCACCACAAACACABBCACCACCBCBBCBABCBA.exe
1⤵
PID:7172

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCABBBBCACBBAAAABCABCCBBBAABCCABCBABCBBCABCCCCAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCABBBBCACBBAAAABCABCCBBBAABCCABCBABCBBCABCCCCAAAAB.exe
1⤵
PID:6240

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBABCCCAABABBCCBCCCACBBBCABABCCCBAACCCAACAAABBACBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBABCCCAABABBCCBCCCACBBBCABABCCCBAACCCAACAAABBACBAAB.exe
1⤵
PID:6576

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBABCCCAABABBCCBCCCACBBBCABABCCCBAACCCAACAAABBACBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBABCCCAABABBCCBCCCACBBBCABABCCCBAACCCAACAAABBACBAAB.exe
1⤵
PID:6632

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABAABCACCBACABCBACBCCBCABBAACCAAAAAAACCABBBABAAABCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABAABCACCBACABCBACBCCBCABBAACCAAAAAAACCABBBABAAABCAA.exe
1⤵
PID:7664

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABABCCBBCBAACCCBCCACCACCACAAACACABBCACCACCBCBBCBABCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABABCCBBCBAACCCBCCACCACCACAAACACABBCACCACCBCBBCBABCBA.exe
1⤵
PID:6252

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCABBBBCACBBAAAABCABCCBBBAABCCABCBABCBBCABCCCCAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCABBBBCACBBAAAABCABCCBBBAABCCABCBABCBBCABCCCCAAAAB.exe
1⤵
PID:9516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

virus_log.txt

Path C:\Users\Admin\AppData\Local\Temp\virus_log.txt
Size 1KB
SHA256 60952c978e71b0affce55fb99307741141e55ea2931981c00336c73e96d55167
MD5 a5eb20c08de2010652a0e0c52a27b6aa
SHA1 3aa76f67a9a76592b66651500bdbe5709940034a
SHA512 14e81832abe397e2611743d5b8762c48da543214d0efb48a7ed392cd06ce648abd38524e913ed66369fc5af6eb20c03967f4182f57412a5b6661b77e9771a8c1
TLSH
T10C415C13C0ADE83F90515887AA3FDF9CC4E4769F5C6856289354431677B5C73DE5A0C1
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 67a40717bdd3bfda26fb31e4913575b77f01110c4cd100dc0918e071a7d9eb56
MD5 cb544df4cf0110f8045a4bebc42398fb
SHA1 651e7b72c4961db212565d2b22ed30120f7ae38b
SHA512 b69b2e854a4b3405d134c256d991d7326d734e0c38d1a5d88e9c032a62a0f2123cb8978b5f4871471adc0eee1c9037744617484b09844b952c701226d4bceb42
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ef848f3384b7e5959591189fada66643ec8f6ad235774f8daa2d73a8eb36a4a3
MD5 a6f59fe70ea7f42ddaa66dea3ce23a8d
SHA1 bbd8a4b8e7539968316fd4a580ff7f0764035552
SHA512 e989c13b84201dbe066309d243ae2550e63994689fe34930af0f4418909c526fafd4dd35999ebc7eb12557e7c4b5750996fc619abf7897ef002fa7a709d1bbbb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 468469d6eb8ee03b5e906fb9bb1fccabf16b7e2c1cbb1d0563c4bbbe7fd3a7d8
MD5 e45e610ba402edd140ca42adf360edaf
SHA1 24952ba83ad98d74f3d7b14dae20580136501da0
SHA512 a36158573864fb0775aa4c5b3996924c5884860bf10f8b60d7195aad3b51ebfd63ff3e3f613837b392557afdc04dbda785e2128533b41ca1352b96ee5963b18b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5c28e3f267dfa598086536fcc949b4d54773b2a5c64872d0916d3a79e4780f26
MD5 fbfb773ed805505acaa882ee0281a44b
SHA1 08703dc2d702e38b3569f2c7523e56169adcc09c
SHA512 f57a450c832670ec17fe09fa465b593a35cbfbc49f8b3d2433a337fb49ffb4ff5a3c84a75354f045ad1ed8b9381b5a9fb8266bbbabfa8f6cadb57fe7a366229c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 71341c04ec8d4f00088c506fdf9a6f995095f2fd1f0462cf28424c979cef4044
MD5 0d956d666ce25249aa621a102100561e
SHA1 e864571d3df0151544b5cfccde87cbd6052b49f0
SHA512 fcbea7b0bab8ccef49b79ba59fae854862eece964cee14ceed8554efd0c2ee0ddcd630e8cc5c4c92ac3849b772b07c398ae0b126f169a48aa4cd4e4f60c454e7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0743494b510d59f3d4d246653974b5b5d6d7ce4f6331ab222a1351c60d3e5c8a
MD5 5f370dc5444c9ec6db208b723cea4692
SHA1 4538e7c4f1544c5e7bbd69bec187324ba767af13
SHA512 e33fde6afb200e32819f9934a678a0360506e5d25ec48b18b8dc73a8d027eed201b1b09130b1b013c8055fec2e7e2ce8aa094d84dd8e46b1590645132ae60e3f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 348ced51add1defe0af6dafda2a4d026341face61b4ef59e1f0d1506d693d936
MD5 b8886fa12cec6e8cfb081f4fc16e8ae6
SHA1 4271c51b33b3cc77b6fc06cd666a4080307fc048
SHA512 a2b4a5380d7767332a9fbd2e95ac0c8053a78e1e26ec60c5faf1c5cab0d2742734fc89b64d68194bb2787898672c3e059f13ba20f7bc0be64bcf7919b4176496
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 efa8b828334acccc62ee6aef23cedaf077ba14546c9d9bbb86146947763a503c
MD5 61e321a033eb44acb66b2f856b69a3cf
SHA1 5695cc4d3f69a1f5109420763ceea670112d1fc2
SHA512 dd225b671961ac964f8fccf1b96aa67b566b84a429c486bc90ec8533209a8d84f09e0f59d9b35f91074edd2fe084598a9667bbe3d9ba50346bae71d65b2967b3
SSDEEP 96:oPueuW1P1oQ45nNH3c43fTpz+wy+ixNl4vuXb0K1Dst4sEC4QK1DV4CCO+cOf+wJ:BXWhINO3fl4292fK4OE0U8Y
TLSH
T147911536E069DC6BE22164C7953EEBD188E4739F9CAC9A18134D8318BBB5C738D0D4D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 b024d5517782893985a002a357d132a80f1326a90aa69fef8889f20803a58fa4
MD5 5a78bd055bae91eaedb7f06aa1904cbd
SHA1 c82e76c0d34e64c6c2b9fdd4fb1050eeaf4910c2
SHA512 0b8807963b6dd723bed004e205946b332ece50e334862349c88fda5a6d70e98d12ffa0f9fee00324320822cb1ef09628da6a097b141b875f6e500d6a6fa7a99f
SSDEEP 96:oPueuW1P1oQ45nNH3c43fTpz+wy+ixNl4vuXb0K1Dst4sEC4QK1DV4CCO+cOf+wi:BXWhINO3fl4292fK4OE0U8cTQ
TLSH
T1F7C1D736E069DC6BE12168C7953EEBD248E4739F9CAC9A18134D8318BBB5C73CD094E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 5067eca0f17d2d322791b7ccce0ed9f4fcc8e76c226c032406d368f0957825e9
MD5 3560623520a6a126c7f4906012dcb88a
SHA1 7d8473584312290eb1f460e5d9538ace497382e2
SHA512 79316c15ddc01a6dab86a61dc8a612fc8cbf5f1412694b35cb4d24a00957f31ef50f36d3267c83f82ee12539ab77cd3170af69b41b7868b5d097b7571e41542d
SSDEEP 96:oPueuW1P1oQ45nNH3c43fTpz+wy+ixNl4vuXb0K1Dst4sEC4QK1DV4CCO+cOf+wD:BXWhINO3fl4292fK4OE0U8c5
TLSH
T181C1E636E069DC6BE22168C7953EEBD148E4739F9CAC9A18134D8318BBB5C73CD094E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 36553c5069d6c3faf365f004f438a0034631cc2fca75e5e2860b739299371bab
MD5 f58c842e029b9fa9b71ef848d3a77dad
SHA1 bbb97799efc91c0c22f7289ce0d32fb9a3e6bb00
SHA512 7ec85e7ae0d196b4b4bcdfd41148855c8d8922c5f00982e8fa9397f5f02fe5d442f7069d8ee70939c676a3399432e95ec5a5d28283c5912851c4480ade26d90c
SSDEEP 96:oPueuW1P1oQ45nNH3c43fTpz+wy+ixNl4vuXb0K1Dst4sEC4QK1DV4CCO+cOf+wu:BXWhINO3fl4292fK4OE0U8cTbQ
TLSH
T164D13A26E069ECABE12168C7953EEFD148E4739F9CAC9A18134D4318BBB5C73CD194E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 7KB
SHA256 6c722ef00386e743e10269fed3e473c9b69327fb567a11a7930ed483b3f3a9ab
MD5 6c70844e9100707df8e259a861519909
SHA1 d6c51a6b3951ce53f6306ef2abaec13446ebdd8e
SHA512 54a03c2b6b50a49b4ed0c5018112ff010e218794dba2822b2d583e307f5e4abed9134428ceebacdb1266bc7441ca6a4a3de3bcee9bc67aba4409cd4ce46c78cc
SSDEEP 96:oPueuW1P1oQ45nNH3c43fTpz+wy+ixNl4vuXb0K1Dst4sEC4QK1DV4CCO+cOf+wZ:BXWhINO3fl4292fK4OE0U8cTbhUq
TLSH
T149E10A26E0ADEC6BE12164C7953EEFD188E4739F9CAC9A1813494318BBB5C73CD194E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 7KB
SHA256 03b5777b3b5400c968b025d3686bce529b006b902a019ab0ab891b36c13907ce
MD5 1b82c9fd0cc905d8d49be53adcd0e7dd
SHA1 cfa895c575750dd9232f8c8519d5e8477e0994c5
SHA512 06492c8bba6c44bedf102c61c1177b88af689e95ba4f64fe9fd1f28c28a65fbb006e3d6e2bd82cfb6f9aa17de2d60a6f79f8233cf7333ccfd8272fcc38538ff4
SSDEEP 96:oPueuW1P1oQ45nNH3c43fTpz+wy+ixNl4vuXb0K1Dst4sEC4QK1DV4CCO+cOf+wS:BXWhINO3fl4292fK4OE0U8cTbhUS+
TLSH
T195F10A26E0ADEC6BE12154C7953EEFD188E4739F9CAC9A1813494318BBB5C73CE194E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 575B
SHA256 82398fe1def10f1d44c7781365813f8914d208fa8b5dea1a2089494df83daed2
MD5 68e31b6ce8cbb245d877d7745421a83b
SHA1 a7d609ff59c26a42c83b16bbb2b3c7c098accdac
SHA512 554395582b44fdc23741925148811a014eb28b00cf94347ef94657a06cd0e3b3cb4e3bd95e3300f8e958fc7cfe88b4a84c553e1dc138a0fe5ccd98e8535f9def
TLSH
T197F062A5C07DC85B91342983D62EDB8288DC754F6C689968128552187FF9C63CE0D4AA
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 8KB
SHA256 8f15829926808f9eba8f5c3f558ea39b6c04f2ae7eeb64acac341bf584bd6984
MD5 b28556a159e1907c4e5f5970098226fe
SHA1 c0e6b150c8aeb71b40a62cf1a356b6d471796d34
SHA512 86515ade5ce922a4d0b2931e3f736bc1b91c1ef1aad08e1cb8cda3dd1d46f39c30ab0ce000d898e4f2167f1c4c3ed7d120236de7a9b07fc060507716233fd9a8
SSDEEP 96:oPueuW1P1oQ45nNH3c43fTpz+wy+ixNl4vuXb0K1Dst4sEC4QK1DV4CCO+cOf+wE:BXWhINO3fl4292fK4OE0U8cTbhUSSzh
TLSH
T17D020926E0A9EC6BE12168C7953EEFD148E4739F9CAC9A18134D4318BBB5C73CD194E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 9KB
SHA256 d9a5e4c49c7b8e874c9c75ebcaa0707c85cd359607406bd1116c7cccebc74111
MD5 1105fc4385ee2efff07012543ccc2ebb
SHA1 897c5a4c14723568e01b46f067da3d0eb14a951d
SHA512 3a3b2492e1a86647ab83941013a2cbd17552c8743a71c6c72cd775e4e774ed1179d952b7d9a0f92775322bc558f59dc9220a73ceaa4bfa6b55587d2e4692a14d
SSDEEP 192:BXWhINO3fl4292fK4OE0U8cTbhUSSzC64x:BXZNOPm2cfPOE0U80hUSEp4x
TLSH
T108120826E0A9EC6BE12168C7953EDFD148E4739F9CAC9A18134D4318BBB5C73CE194E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 9KB
SHA256 f84e94f6326058fa3bc0796354552c37b697e19740c584144487f409caccf3db
MD5 58a17525a81f6bbd0f0fd6c923dd215f
SHA1 59135bb66cb35080b4fd0897a1c38bcd0f0c2f33
SHA512 71c5cc83d51c2b10ce1f95d5d81cdc928588003f60b2dde346690c1775851a70872c6725b49d432768e9cb6ad4f423869ae717443501074302e470107673a785
SSDEEP 192:BXWhINO3fl4292fK4OE0U8cTbhUSSzC645WZ:BXZNOPm2cfPOE0U80hUSEp45WZ
TLSH
T165121826E0A9EC6BE12168C7953EDFD148E4739F9CAC9A18134D4318BBB5C73CE194E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 9KB
SHA256 6cc93d8b45b09e2bd529602bcd1b5ae9c2b87adf666ebc1f318ae76eeed8ee84
MD5 0f35f0ed129e770bcccdfb42a6a24d5f
SHA1 a87b041a753d56a33f5d1905bb7b4ddfd7640cc7
SHA512 609068496402176bee3fbb06fad208f5027049306ad5dd08e09c3a46e405c79aa338c05a0b18986b73dafba22c23f6ff65fb5a38c7b640151896b83dd0331738
SSDEEP 192:BXWhINO3fl4292fK4OE0U8cTbhUSSzC645WIp:BXZNOPm2cfPOE0U80hUSEp45WIp
TLSH
T11F120936E0A9EC6BE12168C7953EDFD148E4739F9CAC9A1813494318BBB5C73CD194E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 9KB
SHA256 38906a8ceba2b5667b22b6da9b7c844124e266afa3142ccf047c3ebea60767f9
MD5 9308838d618f3951c9c2ad1ee762d23b
SHA1 a04264b2b0654e76de15206ae6dcf0c65aa94c6b
SHA512 f34fd21db5e63cf5445ed5bf5c67dcf4e246077e288203521546a51a579809d8b1f6afcb4aab685207a71c62f196ed22f9e178e7aa283be94ee16c26284d45a1
SSDEEP 192:BXWhINO3fl4292fK4OE0U8cTbhUSSzC645WIhk:BXZNOPm2cfPOE0U80hUSEp45WIhk
TLSH
T12A220936E0A9DC6BE22168C7953EDFD148E4739F9CAC9A1813494318BBB5C73CE194E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 b3e5383f0d84007b35eb79187e744f795520802d721f5be08d4b8002d423b181
MD5 3cbd1c96c71b25672436fe3f63d0f820
SHA1 fe2c6801c745a24cefcdb70b0adf0157e7d57519
SHA512 caccdcb7d5887613a754894be4411f5ecadd77f9c8c972fe647b3a0e85061f4f7e50a1158d0a6cfa7af3d97e764286590cbae13da22af1fe1d40ad2772725681
TLSH
T18F21C966C06DDC67A13524C7D62EDBC288E8758F6C6CAA68134D43187BB9C73CE0D4DA
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 10KB
SHA256 3e1b542a7a9f30dd4209419a9595753dfbae6d395c3d31e9fac0c28dd45f9561
MD5 4cea77e7a428c25295c13fb379a78e9c
SHA1 6e26d314a49ec921930fcfd97ca8f88372bc0110
SHA512 a6ca8f0556dc62a62cecd6c1df548e2a8d617596ea25fef3a76022f4df3f5f5653b6819aae1ab6b72a8810167715dc3a04b84147b3781d9e807245e738f7844a
SSDEEP 192:BXWhINO3fl4292fK4OE0U8cTbhUSSzC645WIhJtE0n8U:BXZNOPm2cfPOE0U80hUSEp45WIh3E0nj
TLSH
T1B3320936E0A9DC6BE22268C7953EDFD148E4739F9CAC9A1813494318BBB5C73CD194E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 664B
SHA256 00d0c0862323f40f583d1f610e62db2669f656b3f5a83f63f7f64793bcdc6330
MD5 fcfb228955dc13736e85a0001266ed2b
SHA1 03d6b615feb29e27e91449448564afd9197c4618
SHA512 25c30fa5ed35981a356991b24823463bd7d3d98f1053e8e90549b34a7abf21236a2c9a46e0eda37408be92864805ed220ed2d06b391e47ce21874bb4427a89fe
TLSH
T18B018655C07DD85B91342983D62ECB8788D8754F6C78EA28238553187BF5C638E0D49A
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 fe9992eac9318cc45718c6d89a802d3b17cff32b8843375bd187d89c5831f522
MD5 33a9c149f9bea6e37802f0179ec1cac1
SHA1 d5d9e294c356b452504df62aba25aa211f9f929e
SHA512 5bc626a9d744d44aea89093bc0cd2748543478769a2a7b944ff045b657253133b3d6b5a7b1b0df57a3065fa32bda18cbdaadd9e73a5ad345155da2cb6d2c78c6
SSDEEP 384:BXZNOPm2cfPOE0U80hUSEp45WIh3E0n8qg:BXZNOPcfPOE0AiRp4cIRvn8qg
TLSH
T176420826E0A9DC6BE23268C7953EDFD148E4739F5CAC9A1813494318BBA5C73CE1D4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 ffb37f2e05bc7720ad117a2e5aa3ea9faaeead2613e33e255cb5cf2ddc57b8e2
MD5 c9afbbac3fa15f2486b45f408cec9058
SHA1 c8e136e29c35e6ae1d41528a94cc2aaefc70faee
SHA512 96eec9660d0e9ec49d3104cfd1f8668738064ade3cce04c7f49738ce863fe4700e787ee8006dff9732d2e3d3a23a32144e30475e8f3e42a2e252301e05670217
SSDEEP 384:BXZNOPm2cfPOE0U80hUSEp45WIh3E0n8qab7:BXZNOPcfPOE0AiRp4cIRvn8qab7
TLSH
T1C3420926E069DC6BE23268C7953EEFD148E4739F9CAC9A1813494318B7A5C73CE1D4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 1dad2e2f47258081eae95837e98d7241b6c8e738a76e33e875b2e805e04f6ca1
MD5 f0ec8216346b8e3df957193309a57c6f
SHA1 744df23dc2941aa858725f038594203721f9acf4
SHA512 618fd8551fdb240e03c7cff8e725b5eaf95b32b7a9e53342d71a4bace78ddb6a07d0cd826a1a621cf13a7f8e3b3cb360431427a159162858527de4f41e6b0105
SSDEEP 384:BXZNOPm2cfPOE0U80hUSEp45WIh3E0n8qabBk:BXZNOPcfPOE0AiRp4cIRvn8qabBk
TLSH
T111421926E069DC6BE23268C7953EEFD148E4739F9CAC9A1813494318B7A5C73CE1D4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 44105e37668152861e2e0709d12b2defc4f5c8d9b4a560d0951ba7f5b6f37a92
MD5 8d28be958719220f6d27dd3fb3c00b86
SHA1 b818d02c14bf9e93b82c376a837cd74695b39070
SHA512 17f02d94986e0cfc84e0016508a9c4882231842feb4dc0cbcad483d031560d1b2acf1ffc85ac286ef49f35820377eddc4ec5561bfeaf6821aa8a45f3e2b05edb
SSDEEP 384:BXZNOPm2cfPOE0U80hUSEp45WIh3E0n8qabBjkD:BXZNOPcfPOE0AiRp4cIRvn8qabBa
TLSH
T131422936E0A9DC6BE23268C7953EEFD148E4739F9CAC9A1813494318B7A5C73CD194E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 cbe95116d66b008e28758edf6c717c390219804d054b86e65eba21505c2a95c9
MD5 a55b4b52c00d7c14df0820ff4f30e622
SHA1 9d422f0ffc13602a0ef115d64c3ca9cbae68f7d3
SHA512 fd24c10633ceea4be0eb8a1a35c867eda23c00bb166bf483f54eb6f4b6851a4dce94d6fd9087f6b38c04d58fbe01898dbaa78044b60f1d3567ee68a31a954565
SSDEEP 384:BXZNOPm2cfPOE0U80hUSEp45WIh3E0n8qabBjkJ:BXZNOPcfPOE0AiRp4cIRvn8qabBS
TLSH
T15A621A22E069DC6BF23268C7953EEFD148E4739F9CAC9A1853894318B7A5C73CD194E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0469c72889dd92300758fec6acf24fffd82eee5b1323968ad481769bfd279c15
MD5 da54d6dad0aaa7d51f1f2cbc570bf202
SHA1 e17c18457ea54f2350461c2f722c265812b984bc
SHA512 283745ad0f16025ece02bcc8191555550e8d9bd29b3180b9593ee8af76446dac4219eaac6c33633020372079db9b40c3a28507a507d95ed206728104342b9e90
TLSH
T1D9311C26D069DC67F23528C7952EDBC289E8758F6C6C9A28134D43187B74C73CE1D4EA
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 3af69875ac33895b351039f3d256b7edd86c4feef5e35310fed7719f2b4f9607
MD5 a4ddf251b24c127e9fa38cbecaee76a4
SHA1 c49f21b6580731214d26633467e96c836701feb1
SHA512 a13341d2b431a3a043010f4d97c73052e547b00fc5b5db9948d250a5166600d5aa1237cfc0832b47f17cfbd7a1b31644feab25f59d1278122c13adcd16d795b3
SSDEEP 384:BXZNOPm2cfPOE0U80hUSEp45WIh3E0n8qabBjkVA:BXZNOPcfPOE0AiRp4cIRvn8qabB+A
TLSH
T1B4620922E069DC6BF23268C7953EEFD148E4739F9CAC9A1853894318B7A5C73CD194E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 93c3be16e536814356685bfa03eadc372cc230f98af2567dd0d202d817394331
MD5 37f6e440cd51efbc04340fac212d827a
SHA1 bd1550b8a4eb213ac31c7464a1c5080a084b918b
SHA512 70d87d4821084e345f461fabe0ddc277f3db5ef2ccc3a3d0a9998e46846e5050146139b6fe52352fee000a32ca8b230579d57dc4ed1c6557c7286ca705e86027
SSDEEP 384:BXZNOPm2cfPOE0U80hUSEp45WIh3E0n8qabBjkVdl:BXZNOPcfPOE0AiRp4cIRvn8qabB+dl
TLSH
T1A5620922E069DC6BE23268C7953EEFD148E4739F9CAC9A1853894318B7A5C73CD194E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 276fd144964c7405afd8eca218e9c8629cb141122c08bf0f3fe2cbb30784b63c
MD5 7940f0ec6c9ccd5efc79791009f5930a
SHA1 64829504b62bf462c6b6095b9141913a13649083
SHA512 e018d6b434016ba9c233d48598469031984341fa9447954b31bd575a2ddc36c3dfddc6b83c37973dca25e072478b0368d40895cfde9c4e553f67767100847e3f
SSDEEP 384:BXZNOPm2cfPOE0U80hUSEp45WIh3E0n8qabBjkVdxs:BXZNOPcfPOE0AiRp4cIRvn8qabB+d+
TLSH
T1BA620922E069DC6BE23268C7953EEFD148E4739F9CAC9A1853894318B7A5C73CD194E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 15KB
SHA256 a099da39612dc5481df8f61f2e35fa1a6c072bea83b5a080ba7f042f923cc7df
MD5 76fb0aa68b6f512135a9249faadf0bf2
SHA1 c9e41ddf6c13a7d96e34631dd388b0e2acbb85bd
SHA512 d5eac29b2cfe2da517e915109e3e7b428827fcacece34a6b005541ddfc39b60b84e25d7a4909f66d602a3bebdfbe669f08ac57a0b6b15a2d2357c6b3392ead45
SSDEEP 384:BXZNOPm2cfPOE0U80hUSEp45WIh3E0n8qabBjkVdx3BX:BXZNOPcfPOE0AiRp4cIRvn8qabB+d7X
TLSH
T1FF62FA22E069DC6BE23268C7953EEFD148E4739F9CAC9A1853894318B7A5C73CD1D4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 15KB
SHA256 3c1217b8d21747af134907286d61f2654ca6b03cdc2ba2c642b6c5c2b6502928
MD5 5126a1684e2084fba5fb226539dc6529
SHA1 234b7f54baf2dc69a774aa9b516e5313f59881f7
SHA512 ca525a3f8fc791e50278fd70f8399e3b4ff68e1301bdb75551fc182832c3c627806efe1d177ffbcdad854c5159a44655840b5f463eee5c466305117948e8b334
SSDEEP 384:BXZNOPm2cfPOE0U80hUSEp45WIh3E0n8qabBjkVdx3BXlb:BXZNOPcfPOE0AiRp4cIRvn8qabB+d7Vb
TLSH
T15862FA22E069DC6BE23268C7953EEFD148E4739F9CAC9A1853894318B7A5C73CD1D4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 d9697fc38bb1717bb5efd324d2a91febd2193ca77b9bb52b7e3fc2a3b9760c7b
MD5 234d2b7c4ee79cd41a9d77122c2beafc
SHA1 4ea18789072e4aa18b72074f0dd325d2e221a98d
SHA512 44ba5d2f4dbef63fe96eaa4b88afdcf7796322091cd4d633a2ab281a605ad169fc573489caef13eabbec0900415b95d6dead839ed05d717cda8f6e71d58297a2
TLSH
T14B410C26E069DC67F23524C7952EEBC189E8728F9CAC9A18134D8318BBB4C73CD1D4D9
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 c60cc661f818d5f33a8cdc8cd6f805da5ec95608e6ef35ecbb3fc58ed0dc68a7
MD5 cc7affca1a037adec257177d96067c67
SHA1 912f729bffca710a9de9c0f75ec664e1a6650c0c
SHA512 705f99afa0aa700a57777f1fbf4021271eee790431c1c1b3b6ea31832e944182c2c4c8820755bd70de5966174bda54077eb4b0590e8bcb819929395f4e491233
TLSH
T19241EC26E0A9DC67F23524C7952EEBC149E8729F9CAC9A18134D83187BB4C73CD1D4D9
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 9d092ba783bc7793b400ed0d518ac114f3982a3945188fb8c0ef00882d5a50cc
MD5 def3d26691f4a7acb84101cc8caec2b5
SHA1 8ec0a8dde89b0c8e9ba21411bf304843285c13fe
SHA512 01fd7b6cabfecd09b0b50339e29e1ce2078ec3116f1bbe8d145ad132742f9d7c809f285dc5efe2cf3d2700d7a19bad2124adca2aafa47d61a2479afe490d13e5
TLSH
T14A41EB36E0A9DC67E22518C7952EEBC149E8729F9CAC9A18134D83187BB8C73CD1D4D9
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 72075b7981632809159451351a5cf79b1d01c2bd40f4f592c760e46e0b7561d1
MD5 0e7149a08290a9edc595d38d9d7eec22
SHA1 3ebd9ce6025a0315039d32f4d69719ba5bf7b88c
SHA512 b9cd0ed3b4c616c541969728394ad267d9c9648e359aaf54da134ba924955d7ba2110c0b18c8c9b9dcb4f3b8d70e3b1a509e6ca1319a83c1d3304677aeea4aaf
TLSH
T16C51FC36E0A9DC67F22518C7952EEBD148E8728F9CAC9A18134D83187BB8C73CD0D4D9
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 a83515c4890c3f400f8e80e7780964b5dab51125cf700324e397cb0abadfd501
MD5 3b777d9dd51ae2d6a534c30efec66d23
SHA1 cc783f60cd07ab3ddc66b8836be1334205900d03
SHA512 a9963650837132e55c69f39cc6a6e38c98e4fd85b270d43b9e80b3b3ea890943a924bea0bf8b17d2535e3946ea09188df9d1215f455e60fcedcb1ab4a480e7ca
TLSH
T100811B26E0A9DC6BE13125C7953EDFD288E4728F9CAC9A28134D8318BBB5C738D1D4D5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 e704b29fa68df1520e38146e44897dc4e0094178937dea552ed5321727ea2690
MD5 8339480de92b737c25b387fd2e789283
SHA1 8281ade3282269e109cb1c20af2cab5fcd8ca13b
SHA512 6da396cbbe74b07b2745b763d443df63b0ea9c9e6b706e0170ed2261f343a2049c4802613a952d1acec451a3922eda3060b27026bf404a0ad405036d773f6a29
SSDEEP 96:oPueuW1P1oQ45nNH3c43fTpz+wy+ixNl4vuXb0K1Dst4sEC4QK1DV4CCO+ch:BXWhINO3fl4292fK4Od
TLSH
T1A5810836E069DC6BE22124C7952EEBD289E4728F9CAC9A18134D8318BBB5C73CD0D4D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 7de88de7864ca0ff03ac9cc2386534c255651d91860dc5814381fad544621c4f
MD5 9420b44476bcd2f93e34f57913ab9696
SHA1 28a212b63ef75856cc656a4cde9d7420381f4ad6
SHA512 6a0a33e858127de1206403c323b9dff41275b76a3f4999f0298e95318d224b2adc076d28e6efd050d3453c27963dec4b0b81feaa8add5b62dc8598aa8dc092e9
SSDEEP 96:oPueuW1P1oQ45nNH3c43fTpz+wy+ixNl4vuXb0K1Dst4sEC4QK1DV4CCO+cOf+wH:BXWhINO3fl4292fK4OE02
TLSH
T12891F636E069DC6BE22125C7953EEBD189E4738F9CAC9A18134D8318BBB5C73CD094D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 60281b74c357b63f9df5dbcecb4640c3c1874d6069572e02aa03f030263af9db
MD5 146e665e6a784ce097248615a519e477
SHA1 672c2daeafdee8617c8804b26ca806ee3c1c96b7
SHA512 a93478c4c4332c3a2db6b63621dafb1401563e2b9b47b26fc3704a013eed77ba8ee409f43fb8c325dedfc55f8417b1bb7644e430ac1f306f8748f86b9fd50635
SSDEEP 96:oPueuW1P1oQ45nNH3c43fTpz+wy+ixNl4vuXb0K1Dst4sEC4QK1DV4CCO+cOf+wp:BXWhINO3fl4292fK4OE0UV
TLSH
T105910536E069DC6BE22125CB953EEBD188E4739F9CAC9A18134D8318BBB5C73CD094D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-404-0x0000000000690000-0x00000000006B2000-memory.dmp

Download

memory/252-582-0x0000000000DB0000-0x0000000000DD2000-memory.dmp

Download

memory/252-437-0x0000000000DB0000-0x0000000000DD2000-memory.dmp

Download

memory/1028-402-0x0000000000690000-0x00000000006B2000-memory.dmp

Download

memory/1236-438-0x0000000000F10000-0x0000000000F32000-memory.dmp

Download

memory/1236-583-0x0000000000F10000-0x0000000000F32000-memory.dmp

Download

memory/1292-706-0x0000000000A30000-0x0000000000A52000-memory.dmp

Download

memory/1888-157-0x0000000000C40000-0x0000000000C62000-memory.dmp

Download

memory/1888-309-0x0000000000C40000-0x0000000000C62000-memory.dmp

Download

memory/2036-44-0x0000000000230000-0x0000000000252000-memory.dmp

Download

memory/2108-431-0x0000000000A20000-0x0000000000A42000-memory.dmp

Download

memory/2108-281-0x0000000000A20000-0x0000000000A42000-memory.dmp

Download

memory/2264-124-0x0000000000AD0000-0x0000000000AF2000-memory.dmp

Download

memory/2264-51-0x0000000000AD0000-0x0000000000AF2000-memory.dmp

Download

memory/2424-405-0x0000000000550000-0x0000000000572000-memory.dmp

Download

memory/2568-47-0x0000000000180000-0x00000000001A2000-memory.dmp

Download

memory/2568-117-0x0000000000180000-0x00000000001A2000-memory.dmp

Download

memory/2684-156-0x0000000000AB0000-0x0000000000AD2000-memory.dmp

Download

memory/2684-307-0x0000000000AB0000-0x0000000000AD2000-memory.dmp

Download

memory/2720-750-0x0000000000BE0000-0x0000000000C02000-memory.dmp

Download

memory/2720-491-0x0000000000BE0000-0x0000000000C02000-memory.dmp

Download

memory/2776-251-0x0000000000540000-0x0000000000562000-memory.dmp

Download

memory/3184-644-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/3972-280-0x0000000000A20000-0x0000000000A42000-memory.dmp

Download

memory/3972-430-0x0000000000A20000-0x0000000000A42000-memory.dmp

Download

memory/4080-52-0x0000000000AD0000-0x0000000000AF2000-memory.dmp

Download

memory/4080-145-0x0000000000AD0000-0x0000000000AF2000-memory.dmp

Download

memory/4116-189-0x0000000000190000-0x00000000001B2000-memory.dmp

Download

memory/4116-244-0x0000000000190000-0x00000000001B2000-memory.dmp

Download

memory/4180-245-0x00000000003B0000-0x00000000003D2000-memory.dmp

Download

memory/4180-351-0x00000000003B0000-0x00000000003D2000-memory.dmp

Download

memory/4736-45-0x0000000000230000-0x0000000000252000-memory.dmp

Download

memory/4828-547-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/4872-403-0x0000000000550000-0x0000000000572000-memory.dmp

Download

memory/4932-468-0x0000000000F10000-0x0000000000F32000-memory.dmp

Download

memory/4932-585-0x0000000000F10000-0x0000000000F32000-memory.dmp

Download

memory/5256-467-0x0000000000DB0000-0x0000000000DD2000-memory.dmp

Download

memory/5256-584-0x0000000000DB0000-0x0000000000DD2000-memory.dmp

Download

memory/5276-754-0x0000000000BE0000-0x0000000000C02000-memory.dmp

Download

memory/5276-492-0x0000000000BE0000-0x0000000000C02000-memory.dmp

Download

memory/5476-186-0x0000000000D60000-0x0000000000D82000-memory.dmp

Download

memory/5676-185-0x0000000000D60000-0x0000000000D82000-memory.dmp

Download

memory/5764-144-0x0000000000180000-0x00000000001A2000-memory.dmp

Download

memory/5764-48-0x0000000000180000-0x00000000001A2000-memory.dmp

Download

memory/6048-252-0x0000000000540000-0x0000000000562000-memory.dmp

Download

memory/6084-0-0x0000000000C80000-0x0000000000CA2000-memory.dmp

Download

memory/6084-12-0x0000000000C80000-0x0000000000CA2000-memory.dmp

Download

memory/6120-246-0x00000000003B0000-0x00000000003D2000-memory.dmp

Download

memory/6120-352-0x00000000003B0000-0x00000000003D2000-memory.dmp

Download

memory/6312-719-0x0000000000A30000-0x0000000000A52000-memory.dmp

Download

memory/6332-718-0x0000000000150000-0x0000000000172000-memory.dmp

Download

memory/6340-758-0x00000000004D0000-0x00000000004F2000-memory.dmp

Download

memory/6340-920-0x00000000004D0000-0x00000000004F2000-memory.dmp

Download

memory/6592-900-0x0000000000740000-0x0000000000762000-memory.dmp

Download

memory/6620-923-0x0000000000740000-0x0000000000762000-memory.dmp

Download

memory/6644-802-0x00000000001D0000-0x00000000001F2000-memory.dmp

Download

memory/6644-957-0x00000000001D0000-0x00000000001F2000-memory.dmp

Download

memory/6668-786-0x0000000000570000-0x0000000000592000-memory.dmp

Download

memory/6668-921-0x0000000000570000-0x0000000000592000-memory.dmp

Download

memory/6952-645-0x0000000000150000-0x0000000000172000-memory.dmp

Download

memory/7080-919-0x00000000004D0000-0x00000000004F2000-memory.dmp

Download

memory/7080-757-0x00000000004D0000-0x00000000004F2000-memory.dmp

Download

memory/7116-970-0x00000000001D0000-0x00000000001F2000-memory.dmp

Download

memory/7116-787-0x00000000001D0000-0x00000000001F2000-memory.dmp

Download