abce3098723f7ea784e071b47597c2ecd1356ec7a570a7b1756c061ab8a39be0

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe
Size 7.5MB
Sample260729-ssvcaaae88
SHA256 abce3098723f7ea784e071b47597c2ecd1356ec7a570a7b1756c061ab8a39be0
MD5 b71e3b9e2168fefa5d4d35ea63be5e9b
SHA1 22e3b974a904886ab0fc08246267db16dd5c330f
SHA512 9a8a57fe1b4b48df464f2a6c64e0849e3d8a74b3e8f34bb30348ca8008a3b1fcb6aa3212f938199eb1d35d6e16bd2c67eacc3df0935dde07acdfc18a49c747cd
SSDEEP 49152:PbE2kZAW2ROQcverO04TcbE2kZAW2ROQcverO04TcbE2kZAW2ROQcverO04TcbEm:b4Tk4Tk4Tk4Tk4Tk4Tk4Ti
TLSH
T11F862A1263EC115CF1F71B72EE39A552A97AFCEE7E12E51E0455340E20B2B14CA6A337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c563-11.dat	INDICATOR_EXE_Packed_Fody

Creates a file in the Startup directory 1 TTPs 8 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_ACAABACAACABCBACBBBACAAAABACBBACCABBABCACCABABBCABABACC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_CCBCCCCBCABACBCCBABBBCCCABACBABCABCCBBAABABAABCBACAABBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_CBBBBABBCBCAABACBBCCBAABAABCCABBBBAAACBCBCABBBCCCAAABCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 59 IoCs

pid	Process
1172	svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe
3908	svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe
5284	svchost_CBCCABCABBABABABABBBBCBBAABBAAACAAAACCABCCAABACABBCBBAB.exe
6132	svchost_BCCBABBCBBCCABAACBCCBABCCBABCBACBABCCBACBCBCCABABCAABBC.exe
5568	svchost_ACAABACAACABCBACBBBACAAAABACBBACCABBABCACCABABBCABABACC.exe
4080	svchost_CCBCCCCBCABACBCCBABBBCCCABACBABCABCCBBAABABAABCBACAABBC.exe
5844	svchost_CBABAAACBCABCBCCABBCBBCAABBABCCAABBAABAACBAACAAAAABBCBA.exe
5448	svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe
5456	svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe
5964	svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe
2396	svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe
4408	svchost_CBBBBABBCBCAABACBBCCBAABAABCCABBBBAAACBCBCABBBCCCAAABCC.exe
6068	svchost_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCC.exe
4056	svchost_CBBBBABBCBCAABACBBCCBAABAABCCABBBBAAACBCBCABBBCCCAAABCC.exe
4988	svchost_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCC.exe
1636	svchost_BAACBBCCBBBACCCCCABCBBCCBABBAABBBBBBAACAAACCABBCACCCCBA.exe
4820	svchost_CABCCBBBACCCACAABBBACAACCCCAAAAACABACCBCBCBCCAAACCCCBCB.exe
2308	svchost_CABCCBBBACCCACAABBBACAACCCCAAAAACABACCBCBCBCCAAACCCCBCB.exe
6000	svchost_BAACBBCCBBBACCCCCABCBBCCBABBAABBBBBBAACAAACCABBCACCCCBA.exe
4364	svchost_CCBBCCAAABACBAACCABCACAACBAACCCACCACAAAAAAABAABBBBACBBB.exe
4196	svchost_CCAACCCBCBABCAABABABCCABCABABCBBAABBBBABABBACBCCBBBBAAC.exe
5636	svchost_CCBBCCAAABACBAACCABCACAACBAACCCACCACAAAAAAABAABBBBACBBB.exe
4876	svchost_CCAACCCBCBABCAABABABCCABCABABCBBAABBBBABABBACBCCBBBBAAC.exe
1800	svchost_AAABAABBBBABBCBCBCACAABBABBBBBCACACCBABCABCCBBABCCABBAA.exe
5564	svchost_ABCBAABCBACABBCCCCCBACCBABCABCBACABBACCBCBAABCCCBCBCCBA.exe
4728	svchost_CACCBAABCCABCABAACBCACCCACCBCBBBCABCBCAAACCBCBCACBCACBA.exe
4064	svchost_ACACACBBAACABBCCCBABBCACAAAACABBCACCCAABBBAACCCCBBBBCAA.exe
2908	svchost_CBCACCBCCCCBCABCBBABCBACABBCBBCABBCACCAAACABAACBAABCCBA.exe
5544	svchost_ACBAABCCCACCABBCABAACCCCCABABABBCCCCBCCBAACACABAABCACBC.exe
2116	svchost_CBAAACACCABABBABBCAABBAACACAABCCCBACBBAABAACBBABABBCAAB.exe
5932	svchost_CBAAACACCABABBABBCAABBAACACAABCCCBACBBAABAACBBABABBCAAB.exe
1828	svchost_ACBAABCCCACCABBCABAACCCCCABABABBCCCCBCCBAACACABAABCACBC.exe
3084	svchost_ACBACCAABCCCACABBCACCABBCAABBAABBAAACCBBCCABCBABCBBCCCA.exe
5972	svchost_ACBACCAABCCCACABBCACCABBCAABBAABBAAACCBBCCABCBABCBBCCCA.exe
6164	svchost_BCCABBACCAACBAAAABBCCCACAACBBBBBCCBBACCCCAABCCAAAAAAAAB.exe
6156	svchost_BCCABBACCAACBAAAABBCCCACAACBBBBBCCBBACCCCAABCCAAAAAAAAB.exe
6540	svchost_BCABCACACBCABBBCACCAACABBCCCABCBBBBBCABCCACCCCACBCCBCBB.exe
5460	svchost_ABBBBCAABACBACAABBACBBACAABCACBCABBACCBBBCCCCBAACBCBBAA.exe
5276	svchost_ABBBBCAABACBACAABBACBBACAABCACBCABBACCBBBCCCCBAACBCBBAA.exe
6224	svchost_CBCABCAACACBBAACAABCBBBBBBBCCABCCCAACAAABBBBCCCACCCABBB.exe
6268	svchost_CBCABCAACACBBAACAABCBBBBBBBCCABCCCAACAAABBBBCCCACCCABBB.exe
6716	svchost_BACCBBABABBCCBCCCBCBBACACCBBCBCCAACBBCABBBBCBACCAABCCAC.exe
6736	svchost_CCCBCAAACAACBBCCCABABBBCCCAAAABBAABCCCCBCCBAABACCAACABC.exe
6740	svchost_CCCBCAAACAACBBCCCABABBBCCCAAAABBAABCCCCBCCBAABACCAACABC.exe
6920	svchost_ACCABACCCCACAAAACBBBCBBCBBACCBAACAACBABCAAABBCCCCCBCBBB.exe
6876	svchost_ACCABACCCCACAAAACBBBCBBCBBACCBAACAACBABCAAABBCCCCCBCBBB.exe
6928	svchost_ABACABBACACACACCBBAABBBACCAACBACBCABCBABBBBCCAACBACBCCB.exe
4940	svchost_ABACABBACACACACCBBAABBBACCAACBACBCABCBABBBBCCAACBACBCCB.exe
6304	svchost_CCABAAACBACACBACBACAAABCBBBBCCAABCACACBAAACACBCCBCAABCB.exe
5156	svchost_CABBCAACABACCCBCBAABBBBABACCACCBCABCCBAABCBBCBBACCABCAC.exe
6356	svchost_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACB.exe
6360	svchost_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACB.exe
5272	svchost_ABABCCCBBCABAABCCACACACACBABBBBBAAABACBBCBAAACBACCCCCBC.exe
6748	svchost_BBACABCBCCABCBABCCBBAABCAABCBACCABAABBCBCBCCBABBCCABCCC.exe
1852	svchost_BBACABCBCCABCBABCCBBAABCAABCBACCABAABBCBCBCCBABBCCABCCC.exe
7420	svchost_AAABCCCBBCAACACBBCACBCBACABCCACABABBBBABBABAAAABCBBAACC.exe
7560	svchost_AAABCCCBBCAACACBBCACBCBACABCCACABABBBBABBABAAAABCBBAACC.exe
7576	svchost_ABACAABABBBCCBACBCBABCCCBCCCBCABCBCAAABCCAAACABCAAACBCA.exe
8112	svchost_CBBBCAACACABCACCABBAABCABABCCCABACAAABCCBBCACBBAAACCAAA.exe

Adds Run key to start application 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBCBCCBBABAAACBACAACAABABCBCBABBCBCCAABBACCCCAAACBBACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe"	2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBABAAACBCABCBCCABBCBBCAABBABCCAABBAABAACBAACAAAAABBCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABAAACBCABCBCCABBCBBCAABBABCCAABBAABAACBAACAAAAABBCBA.exe"	svchost_ACAABACAACABCBACBBBACAAAABACBBACCABBABCACCABABBCABABACC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCCACBAABCACCCCABABAACCCABCCBCBBACBAABCAACAABAACCCCBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBBCAABACBACAABBACBBACAABCACBCABBACCBBBCCCCBAACBCBBAA.exe"	svchost_CCBBCCAAABACBAACCABCACAACBAACCCACCACAAAAAAABAABBBBACBBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACB.exe"	svchost_ACBAABCCCACCABBCABAACCCCCABABABBCCCCBCCBAACACABAABCACBC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBCBCBCBCCBACBABBACAABCCCCCBCACAAABBCBCBCBABACAAAACCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABCCCBBCAACACBBCACBCBACABCCACABABBBBABBABAAAABCBBAACC.exe"	svchost_ACBACCAABCCCACABBCACCABBCAABBAABBAAACCBBCCABCBABCBBCCCA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBAACBACBAAAABAACCCBBCAACCCCAABCACACCCAACBBCACCCCCBABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCC.exe"	svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCAACCCBCBABCAABABABCCABCABABCBBAABBBBABABBACBCCBBBBAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAACCCBCBABCAABABABCCABCABABCBBAABBBBABABBACBCCBBBBAAC.exe"	svchost_CBBBBABBCBCAABACBBCCBAABAABCCABBBBAAACBCBCABBBCCCAAABCC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABCAABCABCBACABACCCAACBBCBAACCBABCBABBCBCCCBCABBCCBCBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCABCAACACBBAACAABCBBBBBBBCCABCCCAACAAABBBBCCCACCCABBB.exe"	svchost_CCAACCCBCBABCAABABABCCABCABABCBBAABBBBABABBACBCCBBBBAAC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBBCAACACABCACCABBAABCABABCCCABACAAABCCBBCACBBAAACCAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBCAACACABCACCABBAABCABABCCCABACAAABCCBBCACBBAAACCAAA.exe"	svchost_ACCABACCCCACAAAACBBBCBBCBBACCBAACAACBABCAAABBCCCCCBCBBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBBCCAAABACBAACCABCACAACBAACCCACCACAAAAAAABAABBBBACBBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBBCCAAABACBAACCABCACAACBAACCCACCACAAAAAAABAABBBBACBBB.exe"	svchost_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCACACBBBBCABCCBBBBBAACBCABCCBBBAABCCCCBCCCBACAACCBCACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCACCBCCCCBCABCBBABCBACABBCBBCABBCACCAAACABAACBAABCCBA.exe"	svchost_BAACBBCCBBBACCCCCABCBBCCBABBAABBBBBBAACAAACCABBCACCCCBA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACB.exe"	svchost_CBAAACACCABABBABBCAABBAACACAABCCCBACBBAABAACBBABABBCAAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCACBACCBCCBBBBAACBCBACCAACABAACBCABBBAACBCCBCCCBACABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCCCAAABCACCCACAACCBAACCACCCCBBCAAABCCACABACBABCBBCBB.exe"	svchost_ABACABBACACACACCBBAABBBACCAACBACBCABCBABBBBCCAACBACBCCB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAABBBCAAABBABBBCBCABCABABBCBBCCBCBBACBCBABAAABBACAAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBABBCBBCCABAACBCCBABCCBABCBACBABCCBACBCBCCABABCAABBC.exe"	svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe"	svchost_CCBCCCCBCABACBCCBABBBCCCABACBABCABCCBBAABABAABCBACAABBC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBACCCBACABAABACBCACACBBACCBBAACACBACCACABACBCACCACCCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCCBBBACCCACAABBBACAACCCCAAAAACABACCBCBCBCCAAACCCCBCB.exe"	svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBABAAAAACBABBCBBBCBBABCACCCCCABBAACACABACCCABCAACABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBAABCCCACCABBCABAACCCCCABABABBCCCCBCCBAACACABAABCACBC.exe"	svchost_CABCCBBBACCCACAABBBACAACCCCAAAAACABACCBCBCBCCAAACCCCBCB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBCCBABBCCBAAAABBBACCACCAABABBBBBCABAAACAAACABABCAACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACABBACACACACCBBAABBBACCAACBACBCABCBABBBBCCAACBACBCCB.exe"	svchost_BCCABBACCAACBAAAABBCCCACAACBBBBBCCBBACCCCAABCCAAAAAAAAB.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4788	sc.exe
2676	sc.exe
8164	sc.exe
8312	sc.exe
8540	sc.exe
1344	sc.exe
10000	sc.exe
2736	sc.exe
9208	sc.exe
1076	sc.exe
1260	sc.exe
9600	sc.exe
6500	sc.exe
6456	sc.exe
8324	sc.exe
10004	sc.exe
4048	sc.exe
6980	sc.exe
1436	sc.exe
1736	sc.exe
4488	sc.exe
2572	sc.exe
2328	sc.exe
6264	sc.exe
7492	sc.exe
7972	sc.exe
9392	sc.exe
5040	sc.exe
5260	sc.exe
6416	sc.exe
7384	sc.exe
3500	sc.exe
5260	sc.exe
2500	sc.exe
1972	sc.exe
9856	sc.exe
10532	sc.exe
4756	sc.exe
8012	sc.exe
704	sc.exe
6696	sc.exe
6700	sc.exe
10056	sc.exe
9500	sc.exe
4688	sc.exe
7768	sc.exe
7096	sc.exe
7600	sc.exe
7596	sc.exe
7840	sc.exe
9356	sc.exe
4604	sc.exe
6524	sc.exe
7344	sc.exe
10360	sc.exe
1200	sc.exe
6976	sc.exe
2824	sc.exe
7540	sc.exe
6764	sc.exe
2036	sc.exe
5652	sc.exe
10224	sc.exe
9484	sc.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6492	cmd.exe
5652	cmd.exe
5268	cmd.exe
7112	cmd.exe
9856	cmd.exe
10224	cmd.exe
9892	cmd.exe
4920	cmd.exe
1732	cmd.exe
7804	cmd.exe
4460	cmd.exe
7248	cmd.exe
9948	cmd.exe
10292	cmd.exe
2708	cmd.exe
2932	cmd.exe
6340	cmd.exe
9088	cmd.exe
5236	cmd.exe
6860	cmd.exe
11156	cmd.exe
4184	cmd.exe
3212	cmd.exe
7900	cmd.exe
7180	cmd.exe
9068	cmd.exe
9376	cmd.exe
10464	cmd.exe
4236	cmd.exe
5656	cmd.exe
6564	cmd.exe
4652	cmd.exe
7624	cmd.exe
8932	cmd.exe
8780	cmd.exe
8540	cmd.exe
8068	cmd.exe
1608	cmd.exe
8884	cmd.exe
8516	cmd.exe
9428	cmd.exe
11204	cmd.exe
2828	cmd.exe
3068	cmd.exe
2204	cmd.exe
10684	cmd.exe
6032	cmd.exe
1132	cmd.exe
6864	cmd.exe
7104	cmd.exe
6636	cmd.exe
5464	cmd.exe
8836	cmd.exe
9848	cmd.exe
4884	cmd.exe
5708	cmd.exe
5332	cmd.exe
7736	cmd.exe
7952	cmd.exe
10068	cmd.exe
10236	cmd.exe
9880	cmd.exe
3244	cmd.exe
3736	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAAACACCABABBABBCAABBAACACAABCCCBACBBAABAACBBABABBCAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBABBCBBCCABAACBCCBABCCBABCBACBABCCBACBCBCCABABCAABBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCCBBBACCCACAABBBACAACCCCAAAAACABACCBCBCBCCAAACCCCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBAABCCCACCABBCABAACCCCCABABABBCCCCBCCBAACACABAABCACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCABBACCAACBAAAABBCCCACAACBBBBBCCBBACCCCAABCCAAAAAAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCABACCCCACAAAACBBBCBBCBBACCBAACAACBABCAAABBCCCCCBCBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCACCBCCCCBCABCBBABCBACABBCBBCABBCACCAAACABAACBAABCCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6896	schtasks.exe
8048	schtasks.exe
3320	schtasks.exe
4680	schtasks.exe
9560	schtasks.exe
6116	schtasks.exe
888	schtasks.exe
7948	schtasks.exe
8236	schtasks.exe
8404	schtasks.exe
8876	schtasks.exe
2696	schtasks.exe
6416	schtasks.exe
4412	schtasks.exe
7176	schtasks.exe
8016	schtasks.exe
4880	schtasks.exe
6360	schtasks.exe
7988	schtasks.exe
3856	schtasks.exe
8736	schtasks.exe
2612	schtasks.exe
9616	schtasks.exe
3320	schtasks.exe
10848	schtasks.exe
3168	schtasks.exe
8684	schtasks.exe
6844	schtasks.exe
9932	schtasks.exe
10516	schtasks.exe
8316	schtasks.exe
992	schtasks.exe
4244	schtasks.exe
2660	schtasks.exe
3936	schtasks.exe
5072	schtasks.exe
6968	schtasks.exe
4488	schtasks.exe
5668	schtasks.exe
2596	schtasks.exe
6408	schtasks.exe
4412	schtasks.exe
1600	schtasks.exe
2308	schtasks.exe
5560	schtasks.exe
2412	schtasks.exe
5048	schtasks.exe
2116	schtasks.exe
4412	schtasks.exe
5528	schtasks.exe
6392	schtasks.exe
9148	schtasks.exe
8984	schtasks.exe
6212	schtasks.exe
6668	schtasks.exe
6496	schtasks.exe
8480	schtasks.exe
9508	schtasks.exe
6212	schtasks.exe
5560	schtasks.exe
4620	schtasks.exe
6952	schtasks.exe
9896	schtasks.exe
3444	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4888	2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe
4888	2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe
3908	svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe
3908	svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe
1172	svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe
1172	svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe
4888	2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe
4888	2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe
5284	svchost_CBCCABCABBABABABABBBBCBBAABBAAACAAAACCABCCAABACABBCBBAB.exe
5284	svchost_CBCCABCABBABABABABBBBCBBAABBAAACAAAACCABCCAABACABBCBBAB.exe
6132	svchost_BCCBABBCBBCCABAACBCCBABCCBABCBACBABCCBACBCBCCABABCAABBC.exe
6132	svchost_BCCBABBCBBCCABAACBCCBABCCBABCBACBABCCBACBCBCCABABCAABBC.exe
3908	svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe
3908	svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe
5568	svchost_ACAABACAACABCBACBBBACAAAABACBBACCABBABCACCABABBCABABACC.exe
5568	svchost_ACAABACAACABCBACBBBACAAAABACBBACCABBABCACCABABBCABABACC.exe
4080	svchost_CCBCCCCBCABACBCCBABBBCCCABACBABCABCCBBAABABAABCBACAABBC.exe
4080	svchost_CCBCCCCBCABACBCCBABBBCCCABACBABCABCCBBAABABAABCBACAABBC.exe
5844	svchost_CBABAAACBCABCBCCABBCBBCAABBABCCAABBAABAACBAACAAAAABBCBA.exe
5844	svchost_CBABAAACBCABCBCCABBCBBCAABBABCCAABBAABAACBAACAAAAABBCBA.exe
5448	svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe
5448	svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe
5456	svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe
5456	svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe
2396	svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe
2396	svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe
5964	svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe
5964	svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe
6068	svchost_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCC.exe
4408	svchost_CBBBBABBCBCAABACBBCCBAABAABCCABBBBAAACBCBCABBBCCCAAABCC.exe
6068	svchost_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCC.exe
4408	svchost_CBBBBABBCBCAABACBBCCBAABAABCCABBBBAAACBCBCABBBCCCAAABCC.exe
4056	svchost_CBBBBABBCBCAABACBBCCBAABAABCCABBBBAAACBCBCABBBCCCAAABCC.exe
4056	svchost_CBBBBABBCBCAABACBBCCBAABAABCCABBBBAAACBCBCABBBCCCAAABCC.exe
4988	svchost_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCC.exe
4988	svchost_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCC.exe
1800	svchost_AAABAABBBBABBCBCBCACAABBABBBBBCACACCBABCABCCBBABCCABBAA.exe
1800	svchost_AAABAABBBBABBCBCBCACAABBABBBBBCACACCBABCABCCBBABCCABBAA.exe
5564	svchost_ABCBAABCBACABBCCCCCBACCBABCABCBACABBACCBCBAABCCCBCBCCBA.exe
5564	svchost_ABCBAABCBACABBCCCCCBACCBABCABCBACABBACCBCBAABCCCBCBCCBA.exe
5568	svchost_ACAABACAACABCBACBBBACAAAABACBBACCABBABCACCABABBCABABACC.exe
5568	svchost_ACAABACAACABCBACBBBACAAAABACBBACCABBABCACCABABBCABABACC.exe
4080	svchost_CCBCCCCBCABACBCCBABBBCCCABACBABCABCCBBAABABAABCBACAABBC.exe
4080	svchost_CCBCCCCBCABACBCCBABBBCCCABACBABCABCCBBAABABAABCBACAABBC.exe
1636	svchost_BAACBBCCBBBACCCCCABCBBCCBABBAABBBBBBAACAAACCABBCACCCCBA.exe
1636	svchost_BAACBBCCBBBACCCCCABCBBCCBABBAABBBBBBAACAAACCABBCACCCCBA.exe
4820	svchost_CABCCBBBACCCACAABBBACAACCCCAAAAACABACCBCBCBCCAAACCCCBCB.exe
4820	svchost_CABCCBBBACCCACAABBBACAACCCCAAAAACABACCBCBCBCCAAACCCCBCB.exe
2308	svchost_CABCCBBBACCCACAABBBACAACCCCAAAAACABACCBCBCBCCAAACCCCBCB.exe
2308	svchost_CABCCBBBACCCACAABBBACAACCCCAAAAACABACCBCBCBCCAAACCCCBCB.exe
6000	svchost_BAACBBCCBBBACCCCCABCBBCCBABBAABBBBBBAACAAACCABBCACCCCBA.exe
6000	svchost_BAACBBCCBBBACCCCCABCBBCCBABBAABBBBBBAACAAACCABBCACCCCBA.exe
4728	svchost_CACCBAABCCABCABAACBCACCCACCBCBBBCABCBCAAACCBCBCACBCACBA.exe
4728	svchost_CACCBAABCCABCABAACBCACCCACCBCBBBCABCBCAAACCBCBCACBCACBA.exe
5456	svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe
5456	svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe
4064	svchost_ACACACBBAACABBCCCBABBCACAAAACABBCACCCAABBBAACCCCBBBBCAA.exe
4064	svchost_ACACACBBAACABBCCCBABBCACAAAACABBCACCCAABBBAACCCCBBBBCAA.exe
4364	svchost_CCBBCCAAABACBAACCABCACAACBAACCCACCACAAAAAAABAABBBBACBBB.exe
4364	svchost_CCBBCCAAABACBAACCABCACAACBAACCCACCACAAAAAAABAABBBBACBBB.exe
4196	svchost_CCAACCCBCBABCAABABABCCABCABABCBBAABBBBABABBACBCCBBBBAAC.exe
4196	svchost_CCAACCCBCBABCAABABABCCABCABABCBBAABBBBABABBACBCCBBBBAAC.exe
2396	svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe
2396	svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	4888	2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe
Token: SeDebugPrivilege	3908	svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe
Token: SeDebugPrivilege	1172	svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe
Token: SeDebugPrivilege	5284	svchost_CBCCABCABBABABABABBBBCBBAABBAAACAAAACCABCCAABACABBCBBAB.exe
Token: SeDebugPrivilege	6132	svchost_BCCBABBCBBCCABAACBCCBABCCBABCBACBABCCBACBCBCCABABCAABBC.exe
Token: SeDebugPrivilege	5568	svchost_ACAABACAACABCBACBBBACAAAABACBBACCABBABCACCABABBCABABACC.exe
Token: SeDebugPrivilege	4080	svchost_CCBCCCCBCABACBCCBABBBCCCABACBABCABCCBBAABABAABCBACAABBC.exe
Token: SeDebugPrivilege	5844	svchost_CBABAAACBCABCBCCABBCBBCAABBABCCAABBAABAACBAACAAAAABBCBA.exe
Token: SeDebugPrivilege	5448	svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe
Token: SeDebugPrivilege	5456	svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe
Token: SeDebugPrivilege	2396	svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe
Token: SeDebugPrivilege	5964	svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe
Token: SeDebugPrivilege	6068	svchost_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCC.exe
Token: SeDebugPrivilege	4408	svchost_CBBBBABBCBCAABACBBCCBAABAABCCABBBBAAACBCBCABBBCCCAAABCC.exe
Token: SeDebugPrivilege	4056	svchost_CBBBBABBCBCAABACBBCCBAABAABCCABBBBAAACBCBCABBBCCCAAABCC.exe
Token: SeDebugPrivilege	4988	svchost_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCC.exe
Token: SeDebugPrivilege	1800	svchost_AAABAABBBBABBCBCBCACAABBABBBBBCACACCBABCABCCBBABCCABBAA.exe
Token: SeDebugPrivilege	5564	svchost_ABCBAABCBACABBCCCCCBACCBABCABCBACABBACCBCBAABCCCBCBCCBA.exe
Token: SeDebugPrivilege	1636	svchost_BAACBBCCBBBACCCCCABCBBCCBABBAABBBBBBAACAAACCABBCACCCCBA.exe
Token: SeDebugPrivilege	4820	svchost_CABCCBBBACCCACAABBBACAACCCCAAAAACABACCBCBCBCCAAACCCCBCB.exe
Token: SeDebugPrivilege	2308	svchost_CABCCBBBACCCACAABBBACAACCCCAAAAACABACCBCBCBCCAAACCCCBCB.exe
Token: SeDebugPrivilege	6000	svchost_BAACBBCCBBBACCCCCABCBBCCBABBAABBBBBBAACAAACCABBCACCCCBA.exe
Token: SeDebugPrivilege	4728	svchost_CACCBAABCCABCABAACBCACCCACCBCBBBCABCBCAAACCBCBCACBCACBA.exe
Token: SeDebugPrivilege	4064	svchost_ACACACBBAACABBCCCBABBCACAAAACABBCACCCAABBBAACCCCBBBBCAA.exe
Token: SeDebugPrivilege	4364	svchost_CCBBCCAAABACBAACCABCACAACBAACCCACCACAAAAAAABAABBBBACBBB.exe
Token: SeDebugPrivilege	4196	svchost_CCAACCCBCBABCAABABABCCABCABABCBBAABBBBABABBACBCCBBBBAAC.exe
Token: SeDebugPrivilege	5636	svchost_CCBBCCAAABACBAACCABCACAACBAACCCACCACAAAAAAABAABBBBACBBB.exe
Token: SeDebugPrivilege	4876	svchost_CCAACCCBCBABCAABABABCCABCABABCBBAABBBBABABBACBCCBBBBAAC.exe
Token: SeDebugPrivilege	6156	svchost_BCCABBACCAACBAAAABBCCCACAACBBBBBCCBBACCCCAABCCAAAAAAAAB.exe
Token: SeDebugPrivilege	6164	svchost_BCCABBACCAACBAAAABBCCCACAACBBBBBCCBBACCCCAABCCAAAAAAAAB.exe
Token: SeDebugPrivilege	2908	svchost_CBCACCBCCCCBCABCBBABCBACABBCBBCABBCACCAAACABAACBAABCCBA.exe
Token: SeDebugPrivilege	6540	svchost_BCABCACACBCABBBCACCAACABBCCCABCBBBBBCABCCACCCCACBCCBCBB.exe
Token: SeDebugPrivilege	5544	svchost_ACBAABCCCACCABBCABAACCCCCABABABBCCCCBCCBAACACABAABCACBC.exe
Token: SeDebugPrivilege	2116	svchost_CBAAACACCABABBABBCAABBAACACAABCCCBACBBAABAACBBABABBCAAB.exe
Token: SeDebugPrivilege	5932	svchost_CBAAACACCABABBABBCAABBAACACAABCCCBACBBAABAACBBABABBCAAB.exe
Token: SeDebugPrivilege	1828	svchost_ACBAABCCCACCABBCABAACCCCCABABABBCCCCBCCBAACACABAABCACBC.exe
Token: SeDebugPrivilege	3084	svchost_ACBACCAABCCCACABBCACCABBCAABBAABBAAACCBBCCABCBABCBBCCCA.exe
Token: SeDebugPrivilege	5972	svchost_ACBACCAABCCCACABBCACCABBCAABBAABBAAACCBBCCABCBABCBBCCCA.exe
Token: SeDebugPrivilege	6920	svchost_ACCABACCCCACAAAACBBBCBBCBBACCBAACAACBABCAAABBCCCCCBCBBB.exe
Token: SeDebugPrivilege	6876	svchost_ACCABACCCCACAAAACBBBCBBCBBACCBAACAACBABCAAABBCCCCCBCBBB.exe
Token: SeDebugPrivilege	6928	svchost_ABACABBACACACACCBBAABBBACCAACBACBCABCBABBBBCCAACBACBCCB.exe
Token: SeDebugPrivilege	4940	svchost_ABACABBACACACACCBBAABBBACCAACBACBCABCBABBBBCCAACBACBCCB.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4328	4888	2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe	89
PID 4328 wrote to memory of 1600	4328	cmd.exe	91
PID 4888 wrote to memory of 5476	4888	2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe	92
PID 5476 wrote to memory of 2020	5476	cmd.exe	95
PID 4888 wrote to memory of 5164	4888	2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe	96
PID 5164 wrote to memory of 2396	5164	cmd.exe	98
PID 3908 wrote to memory of 2184	3908	svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe	101
PID 1172 wrote to memory of 4996	1172	svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe	103
PID 4996 wrote to memory of 2116	4996	cmd.exe	105
PID 2184 wrote to memory of 5668	2184	cmd.exe	106
PID 3908 wrote to memory of 4544	3908	svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe	107
PID 1172 wrote to memory of 2756	1172	svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe	109
PID 4544 wrote to memory of 5640	4544	cmd.exe	111
PID 2756 wrote to memory of 4788	2756	cmd.exe	112
PID 3908 wrote to memory of 5860	3908	svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe	113
PID 1172 wrote to memory of 6084	1172	svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe	115
PID 6084 wrote to memory of 3500	6084	cmd.exe	117
PID 5860 wrote to memory of 808	5860	cmd.exe	118
PID 5284 wrote to memory of 3536	5284	svchost_CBCCABCABBABABABABBBBCBBAABBAAACAAAACCABCCAABACABBCBBAB.exe	124
PID 6132 wrote to memory of 5336	6132	svchost_BCCBABBCBBCCABAACBCCBABCCBABCBACBABCCBACBCBCCABABCAABBC.exe	126
PID 3536 wrote to memory of 2696	3536	cmd.exe	127
PID 5336 wrote to memory of 5560	5336	cmd.exe	129
PID 5568 wrote to memory of 4276	5568	svchost_ACAABACAACABCBACBBBACAAAABACBBACCABBABCACCABABBCABABACC.exe	134
PID 4276 wrote to memory of 4244	4276	cmd.exe	136
PID 4080 wrote to memory of 464	4080	svchost_CCBCCCCBCABACBCCBABBBCCCABACBABCABCCBBAABABAABCBACAABBC.exe	137
PID 5568 wrote to memory of 2764	5568	svchost_ACAABACAACABCBACBBBACAAAABACBBACCABBABCACCABABBCABABACC.exe	139
PID 464 wrote to memory of 2660	464	cmd.exe	141
PID 2764 wrote to memory of 260	2764	cmd.exe	142
PID 4080 wrote to memory of 3316	4080	svchost_CCBCCCCBCABACBCCBABBBCCCABACBABCABCCBBAABABAABCBACAABBC.exe	143
PID 5568 wrote to memory of 1224	5568	svchost_ACAABACAACABCBACBBBACAAAABACBBACCABBABCACCABABBCABABACC.exe	145
PID 3316 wrote to memory of 2940	3316	cmd.exe	147
PID 1224 wrote to memory of 1100	1224	cmd.exe	148
PID 4080 wrote to memory of 5748	4080	svchost_CCBCCCCBCABACBCCBABBBCCCABACBABCABCCBBAABABAABCBACAABBC.exe	151
PID 5748 wrote to memory of 4788	5748	cmd.exe	154
PID 5844 wrote to memory of 5180	5844	svchost_CBABAAACBCABCBCCABBCBBCAABBABCCAABBAABAACBAACAAAAABBCBA.exe	157
PID 5180 wrote to memory of 2308	5180	cmd.exe	159
PID 5844 wrote to memory of 5820	5844	svchost_CBABAAACBCABCBCCABBCBBCAABBABCCAABBAABAACBAACAAAAABBCBA.exe	160
PID 5820 wrote to memory of 4112	5820	cmd.exe	163
PID 5844 wrote to memory of 1712	5844	svchost_CBABAAACBCABCBCCABBCBBCAABBABCCAABBAABAACBAACAAAAABBCBA.exe	164
PID 1712 wrote to memory of 4712	1712	cmd.exe	166
PID 5448 wrote to memory of 4920	5448	svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe	169
PID 5456 wrote to memory of 5028	5456	svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe	170
PID 4920 wrote to memory of 4412	4920	cmd.exe	220
PID 5028 wrote to memory of 4880	5028	cmd.exe	174
PID 5448 wrote to memory of 3736	5448	svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe	175
PID 5456 wrote to memory of 1740	5456	svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe	177
PID 3736 wrote to memory of 4756	3736	cmd.exe	181
PID 1740 wrote to memory of 2560	1740	cmd.exe	182
PID 5448 wrote to memory of 896	5448	svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe	183
PID 896 wrote to memory of 5260	896	cmd.exe	187
PID 5456 wrote to memory of 3664	5456	svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe	188
PID 3664 wrote to memory of 1660	3664	cmd.exe	191
PID 2396 wrote to memory of 4460	2396	svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe	193
PID 4460 wrote to memory of 3936	4460	cmd.exe	195
PID 5964 wrote to memory of 6032	5964	svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe	196
PID 2396 wrote to memory of 5768	2396	svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe	198
PID 6032 wrote to memory of 6116	6032	cmd.exe	256
PID 5768 wrote to memory of 1436	5768	cmd.exe	203
PID 5964 wrote to memory of 2708	5964	svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe	204
PID 2396 wrote to memory of 5720	2396	svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe	205
PID 5720 wrote to memory of 2656	5720	cmd.exe	208
PID 2708 wrote to memory of 5652	2708	cmd.exe	210
PID 5964 wrote to memory of 1132	5964	svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe	211
PID 1132 wrote to memory of 4116	1132	cmd.exe	215

C:\Users\Admin\AppData\Local\Temp\2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_b71e3b9e2168fefa5d4d35ea63be5e9b_elex_wannacry.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBCCBBABAAACBACAACAABABCBCBABBCBCCAABBACCCCAAACBBACABBAABCAABACCABCAAACBBACBACCCBBACCBBCCAABBABAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBCCBBABAAACBACAACAABABCBCBABBCBCCAABBACCCCAAACBBACABBAABCAABACCABCAAACBBACBACCCBBACCBBCCAABBABAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBCCBCCBCBCCACCABACBBBAAABCBABBBBAAABCABCCCCCCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe" start= auto displayName= "UserDataSvc_BACBCCBCCBCBCCACCABACBBBAAABCBABBBBAAABCABCCCCCCBAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5476
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBCCBCCBCBCCACCABACBBBAAABCBABBBBAAABCABCCCCCCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe" start= auto displayName= "UserDataSvc_BACBCCBCCBCBCCACCABACBBBAAABCBABBBBAAABCABCCCCCCBAB"
    3⤵
    PID:2020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBCCBCCBCBCCACCABACBBBAAABCBABBBBAAABCABCCCCCCBAB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5164
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBCCBCCBCBCCACCABACBBBAAABCBABBBBAAABCABCCCCCCBAB"
    3⤵
    PID:2396

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACAACAABCCACCBACAACACBBABBCABBCAACCCBABBBCACCBACABBABCBAAABBCCAAAAAACABCCBBCCACBBBBBAACBBACACACABCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCABCABBABABABABBBBCBBAABBAAACAAAACCABCCAABACABBCBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACAACAABCCACCBACAACACBBABBCABBCAACCCBABBBCACCBACABBABCBAAABBCCAAAAAACABCCBBCCACBBBBBAACBBACACACABCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCABCABBABABABABBBBCBBAABBAAACAAAACCABCCAABACABBCBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBAABCBABCBABCBBCCCABBBBCACABCABBBCBCCCBCBCABACAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCABCABBABABABABBBBCBBAABBAAACAAAACCABCCAABACABBCBBAB.exe" start= auto displayName= "UserDataSvc_BBBAABCBABCBABCBBCCCABBBBCACABCABBBCBCCCBCBCABACAAC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBAABCBABCBABCBBCCCABBBBCACABCABBBCBCCCBCBCABACAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCABCABBABABABABBBBCBBAABBAAACAAAACCABCCAABACABBCBBAB.exe" start= auto displayName= "UserDataSvc_BBBAABCBABCBABCBBCCCABBBBCACABCABBBCBCCCBCBCABACAAC"
    3⤵
    - Launches sc.exe
    PID:4788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBAABCBABCBABCBBCCCABBBBCACABCABBBCBCCCBCBCABACAAC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6084
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBAABCBABCBABCBBCCCABBBBCACABCABBBCBCCCBCBCABACAAC"
    3⤵
    - Launches sc.exe
    PID:3500

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAABBBCAAABBABBBCBCABCABABBCBBCCBCBBACBCBABAAABBACAAABABCCBBACAABBCACCBBABAAACCCBBBABCCCAABCCCBBACBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABBCBBCCABAACBCCBABCCBABCBACBABCCBACBCBCCABABCAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAABBBCAAABBABBBCBCABCABABBCBBCCBCBBACBCBABAAABBACAAABABCCBBACAABBCACCBBABAAACCCBBBABCCCAABCCCBBACBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABBCBBCCABAACBCCBABCCBABCBACBABCCBACBCBCCABABCAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCBBCACACCCCCCCCCACABCBCCCBCAACBBCACCBCBBBCBBCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABBCBBCCABAACBCCBABCCBABCBACBABCCBACBCBCCABABCAABBC.exe" start= auto displayName= "UserDataSvc_AABCBBCACACCCCCCCCCACABCBCCCBCAACBBCACCBCBBBCBBCBAA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCBBCACACCCCCCCCCACABCBCCCBCAACBBCACCBCBBBCBBCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABBCBBCCABAACBCCBABCCBABCBACBABCCBACBCBCCABABCAABBC.exe" start= auto displayName= "UserDataSvc_AABCBBCACACCCCCCCCCACABCBCCCBCAACBBCACCBCBBBCBBCBAA"
    3⤵
    PID:5640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCBBCACACCCCCCCCCACABCBCCCBCAACBBCACCBCBBBCBBCBAA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5860
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCBBCACACCCCCCCCCACABCBCCCBCAACBBCACCBCBBBCBBCBAA"
    3⤵
    PID:808

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCABCABBABABABABBBBCBBAABBAAACAAAACCABCCAABACABBCBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCABCABBABABABABBBBCBBAABBAAACAAAACCABCCAABACABBCBBAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBBCBAABBBAABABACBCBCABACAABAACBBBAABBAACBBBCCCCCBCBBABABBBABAACAACBCCAACBACBBACCABABAACBAAABCCBAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABACAACABCBACBBBACAAAABACBBACCABBABCACCABABBCABABACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBBCBAABBBAABABACBCBCABACAABAACBBBAABBAACBBBCCCCCBCBBABABBBABAACAACBCCAACBACBBACCABABAACBAAABCCBAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABACAACABCBACBBBACAAAABACBBACCABBABCACCABABBCABABACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2696

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABBCBBCCABAACBCCBABCCBABCBACBABCCBACBCBCCABABCAABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABBCBBCCABAACBCCBABCCBABCBACBABCCBACBCBCCABABCAABBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCCCCBCABACBCCBABBBCCCABACBABCABCCBBAABABAABCBACAABBCABABBABAAABBABAAABCCAABBAACCCABCBCABCBABCBCAACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCCBCABACBCCBABBBCCCABACBABCABCCBBAABABAABCBACAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCCCCBCABACBCCBABBBCCCABACBABCABCCBBAABABAABCBACAABBCABABBABAAABBABAAABCCAABBAACCCABCBCABCBABCBCAACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCCBCABACBCCBABBBCCCABACBABCABCCBBAABABAABCBACAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5560

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABACAACABCBACBBBACAAAABACBBACCABBABCACCABABBCABABACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABACAACABCBACBBBACAAAABACBBACCABBABCACCABABBCABABACC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABAAACBCABCBCCABBCBBCAABBABCCAABBAABAACBAACAAAAABBCBAACBACACACAABCBCAACCAACBCBBCABBAAABACCCCCCABAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAACBCABCBCCABBCBBCAABBABCCAABBAABAACBAACAAAAABBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABAAACBCABCBCCABBCBBCAABBABCCAABBAABAACBAACAAAAABBCBAACBACACACAABCBCAACCAACBCBBCABBAAABACCCCCCABAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAACBCABCBCCABBCBBCAABBABCCAABBAABAACBAACAAAAABBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCCCCACAABAACBBBAACBCCBCBAABBABABCAABCCABBBBAAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAACBCABCBCCABBCBBCAABBABCCAABBAABAACBAACAAAAABBCBA.exe" start= auto displayName= "UserDataSvc_CBCCCCCACAABAACBBBAACBCCBCBAABBABABCAABCCABBBBAAABA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCCCCACAABAACBBBAACBCCBCBAABBABABCAABCCABBBBAAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAACBCABCBCCABBCBBCAABBABCCAABBAABAACBAACAAAAABBCBA.exe" start= auto displayName= "UserDataSvc_CBCCCCCACAABAACBBBAACBCCBCBAABBABABCAABCCABBBBAAABA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCCCCACAABAACBBBAACBCCBCBAABBABABCAABCCABBBBAAABA"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCCCCCACAABAACBBBAACBCCBCBAABBABABCAABCCABBBBAAABA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCCBCABACBCCBABBBCCCABACBABCABCCBBAABABAABCBACAABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCCBCABACBCCBABBBCCCABACBABCABCCBBAABABAABCBACAABBC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCBCCBCBBABCCCACABCCABCCCAABBAAABACCCCABCCACACCCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCBCCBCBBABCCCACABCCABCCCAABBAAABACCCCABCCACACCCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCAABCBCACBCBCCAABAAAAAAACBABCAABAAABACCBBCABBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe" start= auto displayName= "UserDataSvc_AACCAABCBCACBCBCCAABAAAAAAACBABCAABAAABACCBBCABBBBB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACCAABCBCACBCBCCAABAAAAAAACBABCAABAAABACCBBCABBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe" start= auto displayName= "UserDataSvc_AACCAABCBCACBCBCCAABAAAAAAACBABCAABAAABACCBBCABBBBB"
    3⤵
    PID:2940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCAABCBCACBCBCCAABAAAAAAACBABCAABAAABACCBBCABBBBB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5748
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACCAABCBCACBCBCCAABAAAAAAACBABCAABAAABACCBBCABBBBB"
    3⤵
    PID:4788

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAACBCABCBCCABBCBBCAABBABCCAABBAABAACBAACAAAAABBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAACBCABCBCCABBCBBCAABBABCCAABBAABAACBAACAAAAABBCBA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBABCABCAABAABABACBCCBACBBCBBABCCBAABACACABCCBBCBAABBAAABBBBCCBCAABAAAACCACCCBAACCBBBBBCABCBCACABBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5180
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBABCABCAABAABABACBCCBACBBCBBABCCBAABACACABCCBBCBAABBAAABBBBCCBCAABAAAACCACCCBAACCBBBBBCABCBCACABBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACCACABBAACCACAACAAACACBBBCCACBAABBBCCACAAACBBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe" start= auto displayName= "UserDataSvc_CBACCACABBAACCACAACAAACACBBBCCACBAABBBCCACAAACBBBCB"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5820
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACCACABBAACCACAACAAACACBBBCCACBAABBBCCACAAACBBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe" start= auto displayName= "UserDataSvc_CBACCACABBAACCACAACAAACACBBBCCACBAABBBCCACAAACBBBCB"
    3⤵
    PID:4112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACCACABBAACCACAACAAACACBBBCCACBAABBBCCACAAACBBBCB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACCACABBAACCACAACAAACACBBBCCACBAABBBCCACAAACBBBCB"
    3⤵
    PID:4712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCCCACBCBBAABABCCBAACAABBCACBBABBBCBABAACCBCBBAABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABBCBCAABACBBCCBAABAABCCABBBBAAACBCBCABBBCCCAAABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCCCACBCBBAABABCCBAACAABBCACBBABBBCBABAACCBCBBAABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABBCBCAABACBBCCBAABAABCCABBBBAAACBCBCABBBCCCAAABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACAAAACBBAAABCCCCBABBCBCCAACABCAAACCBCACCACABACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABBCBCAABACBBCCBAABAABCCABBBBAAACBCBCABBBCCCAAABCC.exe" start= auto displayName= "UserDataSvc_BACAAAACBBAAABCCCCBABBCBCCAACABCAAACCBCACCACABACACC"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACAAAACBBAAABCCCCBABBCBCCAACABCAAACCBCACCACABACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABBCBCAABACBBCCBAABAABCCABBBBAAACBCBCABBBCCCAAABCC.exe" start= auto displayName= "UserDataSvc_BACAAAACBBAAABCCCCBABBCBCCAACABCAAACCBCACCACABACACC"
    3⤵
    - Launches sc.exe
    PID:4756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACAAAACBBAAABCCCCBABBCBCCAACABCAAACCBCACCACABACACC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACAAAACBBAAABCCCCBABBCBCCAACABCAAACCBCACCACABACACC"
    3⤵
    - Launches sc.exe
    PID:5260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCCCCCCCBCBBAACCCBBBABCAAACABCBBBCCACBBACACCCAACCCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBAACBACBAAAABAACCCBBCAACCCCAABCACACCCAACBBCACCCCCBABAAAACCAACCCABACABBACACCCBBABBCBBCBCBAABCAACCBABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBAACBACBAAAABAACCCBBCAACCCCAABCACACCCAACBBCACCCCCBABAAAACCAACCCABACABBACACCCBBABBCBBCBCBAABCAACCBABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAACBACBCBCCAAAABBCBBBBCCCAACCBABCBCCABBAAABCABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCC.exe" start= auto displayName= "UserDataSvc_BAAACBACBCBCCAAAABBCBBBBCCCAACCBABCBCCABBAAABCABABB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAAACBACBCBCCAAAABBCBBBBCCCAACCBABCBCCABBAAABCABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCC.exe" start= auto displayName= "UserDataSvc_BAAACBACBCBCCAAAABBCBBBBCCCAACCBABCBCCABBAAABCABABB"
    3⤵
    PID:2560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAACBACBCBCCAAAABBCBBBBCCCAACCBABCBCCABBAAABCABABB"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAAACBACBCBCCAAAABBCBBBBCCCAACCBABCBCCABBAAABCABABB"
    3⤵
    PID:1660

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABBCABBCBCBBCBCCBABACBABBAACBAACBAABABCABBCCAABABAABBAACCCCBABCAAAACABBBAAACCBCAACBABCBBABCBCBABBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBCCBBBACCCCCABCBBCCBABBAABBBBBBAACAAACCABBCACCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABBCABBCBCBBCBCCBABACBABBAACBAACBAABABCABBCCAABABAABBAACCCCBABCAAAACABBBAAACCBCAACBABCBBABCBCBABBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBCCBBBACCCCCABCBBCCBABBAABBBBBBAACAAACCABBCACCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACBABCCBBACACCAACCABABCBCCCCBCCAACACCABAAAAABCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBCCBBBACCCCCABCBBCCBABBAABBBBBBAACAAACCABBCACCCCBA.exe" start= auto displayName= "UserDataSvc_CCACBABCCBBACACCAACCABABCBCCCCBCCAACACCABAAAAABCCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCACBABCCBBACACCAACCABABCBCCCCBCCAACACCABAAAAABCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBCCBBBACCCCCABCBBCCBABBAABBBBBBAACAAACCABBCACCCCBA.exe" start= auto displayName= "UserDataSvc_CCACBABCCBBACACCAACCABABCBCCCCBCCAACACCABAAAAABCCAC"
    3⤵
    - Launches sc.exe
    PID:5652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACBABCCBBACACCAACCABABCBCCCCBCCAACACCABAAAAABCCAC"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCACBABCCBBACACCAACCABABCBCCCCBCCAACACCABAAAAABCCAC"
    3⤵
    PID:4116

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCABBBBACCBBCCCBCACBACACCBABCACACBACABAAABBBBABAAABCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCCBACABAABACBCACACBBACCBBAACACBACCACABACBCACCACCCCAAACACCCBCAACABAABBBACAABBBCACCCCCBBACBCBAACACBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBBBACCCACAABBBACAACCCCAAAAACABACCBCBCBCCAAACCCCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCCBACABAABACBCACACBBACCBBAACACBACCACABACBCACCACCCCAAACACCCBCAACABAABBBACAABBBCACCCCCBBACBCBAACACBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBBBACCCACAABBBACAACCCCAAAAACABACCBCBCBCCAAACCCCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCACCBCBBCAACCCACCCCBCBABAACACBBBAAAACCCABCBBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBBBACCCACAABBBACAACCCCAAAAACABACCBCBCBCCAAACCCCBCB.exe" start= auto displayName= "UserDataSvc_AABCACCBCBBCAACCCACCCCBCBABAACACBBBAAAACCCABCBBBBAA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5768
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCACCBCBBCAACCCACCCCBCBABAACACBBBAAAACCCABCBBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBBBACCCACAABBBACAACCCCAAAAACABACCBCBCBCCAAACCCCBCB.exe" start= auto displayName= "UserDataSvc_AABCACCBCBBCAACCCACCCCBCBABAACACBBBAAAACCCABCBBBBAA"
    3⤵
    - Launches sc.exe
    PID:1436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCACCBCBBCAACCCACCCCBCBABAACACBBBAAAACCCABCBBBBAA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5720
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCACCBCBBCAACCCACCCCBCBABAACACBBBAAAACCCABCBBBBAA"
    3⤵
    PID:2656

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABBCBCAABACBBCCBAABAABCCABBBBAAACBCBCABBBCCCAAABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABBCBCAABACBBCCBAABAABCCABBBBAAACBCBCABBBCCCAAABCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCBBCBABAACABCCBCCABCCCCBAABBACCCBBBABABCBBCCAACCACACBABAABAACCABBCCCAABAABAACAABBBCCBCBACCBACACCBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCCBCBABCAABABABCCABCABABCBBAABBBBABABBACBCCBBBBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1440
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCBBCBABAACABCCBCCABCCCCBAABBACCCBBBABABCBBCCAACCACACBABAABAACCABBCCCAABAABAACAABBBCCBCBACCBACACCBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCCBCBABCAABABABCCABCABABCBBAABBBBABABBACBCCBBBBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBBAACBBCAABBCBBBCBBBACCACAACCCCABCCCABBAABBBACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCCBCBABCAABABABCCABCABABCBBAABBBBABABBACBCCBBBBAAC.exe" start= auto displayName= "UserDataSvc_BCCBBAACBBCAABBCBBBCBBBACCACAACCCCABCCCABBAABBBACBB"
  2⤵
  PID:5388
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBBAACBBCAABBCBBBCBBBACCACAACCCCABCCCABBAABBBACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCCBCBABCAABABABCCABCABABCBBAABBBBABABBACBCCBBBBAAC.exe" start= auto displayName= "UserDataSvc_BCCBBAACBBCAABBCBBBCBBBACCACAACCCCABCCCABBAABBBACBB"
    3⤵
    PID:2116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBBAACBBCAABBCBBBCBBBACCACAACCCCABCCCABBAABBBACBB"
  2⤵
  - Executes a command shell one-liner
  PID:4884
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBBAACBBCAABBCBBBCBBBACCACAACCCCABCCCABBAABBBACBB"
    3⤵
    PID:3428

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCCAAABACBAACCABCACAACBAACCCACCACAAAAAAABAABBBBACBBBABBCBCACCBABCBABCCCBCCCAAACCACBBBBBACCAAAAACAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCAAABACBAACCABCACAACBAACCCACCACAAAAAAABAABBBBACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCCAAABACBAACCABCACAACBAACCCACCACAAAAAAABAABBBBACBBBABBCBCACCBABCBABCCCBCCCAAACCACBBBBBACCAAAAACAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCAAABACBAACCABCACAACBAACCCACCACAAAAAAABAABBBBACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACAAACBCAAABAACCACCCBCCBBABCAACAAABAAABCBAABABBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCAAABACBAACCABCACAACBAACCCACCACAAAAAAABAABBBBACBBB.exe" start= auto displayName= "UserDataSvc_AACAAACBCAAABAACCACCCBCCBBABCAACAAABAAABCBAABABBACA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:608
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACAAACBCAAABAACCACCCBCCBBABCAACAAABAAABCBAABABBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCAAABACBAACCABCACAACBAACCCACCACAAAAAAABAABBBBACBBB.exe" start= auto displayName= "UserDataSvc_AACAAACBCAAABAACCACCCBCCBBABCAACAAABAAABCBAABABBACA"
    3⤵
    - Launches sc.exe
    PID:5040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACAAACBCAAABAACCACCCBCCBBABCAACAAABAAABCBAABABBACA"
  2⤵
  PID:2148
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACAAACBCAAABAACCACCCBCCBBABCAACAAABAAABCBAABABBACA"
    3⤵
    - Launches sc.exe
    PID:704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABBCBCAABACBBCCBAABAABCCABBBBAAACBCBCABBBCCCAAABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABBCBCAABACBBCCBAABAABCCABBBBAAACBCBCABBBCCCAAABCC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBABCCCBAACBABABBCBCBBCAAAABBBCCCBBBABCAAAAAACAABAACBCCBABACCAAACCBABCABCCBCACCBCABCACCBAABCBBCBCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAABBBBABBCBCBCACAABBABBBBBCACACCBABCABCCBBABCCABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBABCCCBAACBABABBCBCBBCAAAABBBCCCBBBABCAAAAAACAABAACBCCBABACCAAACCBABCABCCBCACCBCABCACCBAABCBBCBCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAABBBBABBCBCBCACAABBABBBBBCACACCBABCABCCBBABCCABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBAACABBCCBBBBBACABCACBCABABBACBBABACABABCAAACABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAABBBBABBCBCBCACAABBABBBBBCACACCBABCABCCBBABCCABBAA.exe" start= auto displayName= "UserDataSvc_ABBAACABBCCBBBBBACABCACBCABABBACBBABACABABCAAACABBA"
  2⤵
  PID:4288
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBAACABBCCBBBBBACABCACBCABABBACBBABACABABCAAACABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAABBBBABBCBCBCACAABBABBBBBCACACCBABCABCCBBABCCABBAA.exe" start= auto displayName= "UserDataSvc_ABBAACABBCCBBBBBACABCACBCABABBACBBABACABABCAAACABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBAACABBCCBBBBBACABCACBCABABBACBBABACABABCAAACABBA"
  2⤵
  PID:3440
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBAACABBCCBBBBBACABCACBCABABBACBBABACABABCAAACABBA"
    3⤵
    - Launches sc.exe
    PID:4488

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBBCAABABAABABCBCABBCBACACABAABAAACCCACBBCCCCABBACCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABBBBBCCACCAACBBCBABBACACBAACABCAABBABBAAAACCACBACCACBCCBAABABBBACBCCCBCBCCBCBACBABACBACACBAACABABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAABCBACABBCCCCCBACCBABCABCBACABBACCBCBAABCCCBCBCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABBBBBCCACCAACBBCBABBACACBAACABCAABBABBAAAACCACBACCACBCCBAABABBBACBCCCBCBCCBCBACBABACBACACBAACABABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAABCBACABBCCCCCBACCBABCABCBACABBACCBCBAABCCCBCBCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBBBCABCCCBBBBAAAACCACBCCAACABCBBCBACABACCABCAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAABCBACABBCCCCCBACCBABCABCBACABBACCBCBAABCCCBCBCCBA.exe" start= auto displayName= "UserDataSvc_BACBBBCABCCCBBBBAAAACCACBCCAACABCBBCBACABACCABCAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4236
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBBBCABCCCBBBBAAAACCACBCCAACABCBBCBACABACCABCAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAABCBACABBCCCCCBACCBABCABCBACABBACCBCBAABCCCBCBCCBA.exe" start= auto displayName= "UserDataSvc_BACBBBCABCCCBBBBAAAACCACBCCAACABCBBCBACABACCABCAAAA"
    3⤵
    PID:4412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBBBCABCCCBBBBAAAACCACBCCAACABCBBCBACABACCABCAAAA"
  2⤵
  PID:6116
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBBBCABCCCBBBBAAAACCACBCCAACABCBBCBACABACCABCAAAA"
    3⤵
    PID:5528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBCCBBBACCCCCABCBBCCBABBAABBBBBBAACAAACCABBCACCCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBCCBBBACCCCCABCBBCCBABBAABBBBBBAACAAACCABBCACCCCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACACBBBBCABCCBBBBBAACBCABCCBBBAABCCCCBCCCBACAACCBCACCBCBABBBAABBABBACACABCCBCABCBCAABBCAAAAAACAAACCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBCCCCBCABCBBABCBACABBCBBCABBCACCAAACABAACBAABCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACACBBBBCABCCBBBBBAACBCABCCBBBAABCCCCBCCCBACAACCBCACCBCBABBBAABBABBACACABCCBCABCBCAABBCAAAAAACAAACCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBCCCCBCABCBBABCBACABBCBBCABBCACCAAACABAACBAABCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACCBCCBBCABBCAAACAACBCBCABCCACABACCCCBAACAABCCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBCCCCBCABCBBABCBACABBCBBCABBCACCAAACABAACBAABCCBA.exe" start= auto displayName= "UserDataSvc_BCACCBCCBBCABBCAAACAACBCBCABCCACABACCCCBAACAABCCBCC"
  2⤵
  - Executes a command shell one-liner
  PID:1732
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACCBCCBBCABBCAAACAACBCBCABCCACABACCCCBAACAABCCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBCCCCBCABCBBABCBACABBCBBCABBCACCAAACABAACBAABCCBA.exe" start= auto displayName= "UserDataSvc_BCACCBCCBBCABBCAAACAACBCBCABCCACABACCCCBAACAABCCBCC"
    3⤵
    PID:2080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACCBCCBBCABBCAAACAACBCBCABCCACABACCCCBAACAABCCBCC"
  2⤵
  PID:1664
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACCBCCBBCABBCAAACAACBCBCABCCACABACCCCBAACAABCCBCC"
    3⤵
    PID:2688

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBBBACCCACAABBBACAACCCCAAAAACABACCBCBCBCCAAACCCCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBBBACCCACAABBBACAACCCCAAAAACABACCBCBCBCCAAACCCCBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAACACCABABBABBCAABBAACACAABCCCBACBBAABAACBBABABBCAABBCCBBCCAABAAABBBCAABAABAABCCCABABCBACACCCCAAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACACCABABBABBCAABBAACACAABCCCBACBBAABAACBBABABBCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAACACCABABBABBCAABBAACACAABCCCBACBBAABAACBBABABBCAABBCCBBCCAABAAABBBCAABAABAABCCCABABCBACACCCCAAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACACCABABBABBCAABBAACACAABCCCBACBBAABAACBBABABBCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCABACAAAAACABCCABBCABABCBACCAABABBAACCBBBACCCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACACCABABBABBCAABBAACACAABCCCBACBBAABAACBBABABBCAAB.exe" start= auto displayName= "UserDataSvc_AABCABACAAAAACABCCABBCABABCBACCAABABBAACCBBBACCCCBC"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5024
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCABACAAAAACABCCABBCABABCBACCAABABBAACCBBBACCCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACACCABABBABBCAABBAACACAABCCCBACBBAABAACBBABABBCAAB.exe" start= auto displayName= "UserDataSvc_AABCABACAAAAACABCCABBCABABCBACCAABABBAACCBBBACCCCBC"
    3⤵
    PID:2636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCABACAAAAACABCCABBCABABCBACCAABABBAACCBBBACCCCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5656
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCABACAAAAACABCCABBCABABCBACCAABABBAACCBBBACCCCBC"
    3⤵
    - Launches sc.exe
    PID:4604

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBBBACCCACAABBBACAACCCCAAAAACABACCBCBCBCCAAACCCCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBBBACCCACAABBBACAACCCCAAAAACABACCBCBCBCCAAACCCCBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBABAAAAACBABBCBBBCBBABCACCCCCABBAACACABACCCABCAACABCCCACCCABCCABABBBBAACBBCBBCCCABBCCBAABCAABCABCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABCCCACCABBCABAACCCCCABABABBCCCCBCCBAACACABAABCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBABAAAAACBABBCBBBCBBABCACCCCCABBAACACABACCCABCAACABCCCACCCABCCABABBBBAACBBCBBCCCABBCCBAABCAABCABCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABCCCACCABBCABAACCCCCABABABBCCCCBCCBAACACABAABCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACBAABBAABABACCACAAABCBCACAABACCBCABCBBBABBABBBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABCCCACCABBCABAACCCCCABABABBCCCCBCCBAACACABAABCACBC.exe" start= auto displayName= "UserDataSvc_AACBAABBAABABACCACAAABCBCACAABACCBCABCBBBABBABBBCCB"
  2⤵
  PID:1136
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACBAABBAABABACCACAAABCBCACAABACCBCABCBBBABBABBBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABCCCACCABBCABAACCCCCABABABBCCCCBCCBAACACABAABCACBC.exe" start= auto displayName= "UserDataSvc_AACBAABBAABABACCACAAABCBCACAABACCBCABCBBBABBABBBCCB"
    3⤵
    - Launches sc.exe
    PID:1076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACBAABBAABABACCACAAABCBCACAABACCBCABCBBBABBABBBCCB"
  2⤵
  PID:5372
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACBAABBAABABACCACAAABCBCACAABACCBCABCBBBABBABBBCCB"
    3⤵
    - Launches sc.exe
    PID:2328

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBCCBBBACCCCCABCBBCCBABBAABBBBBBAACAAACCABBCACCCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBCCBBBACCCCCABCBBCCBABBAABBBBBBAACAAACCABBCACCCCBA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBABAAACCCBABBCCABACABCAABABBCABACBABACBAABBCCAABABCBCACAAAABCCBCCACBCCAABABAAAAAAAAACCCBABCCCCABCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCAABCCCACABBCACCABBCAABBAABBAAACCBBCCABCBABCBBCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBABAAACCCBABBCCABACABCAABABBCABACBABACBAABBCCAABABCBCACAAAABCCBCCACBCCAABABAAAAAAAAACCCBABCCCCABCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCAABCCCACABBCACCABBCAABBAABBAAACCBBCCABCBABCBBCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBBCCCBCCCBACBAABBCACCACCABBACBACACCBABBAABCBBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCAABCCCACABBCACCABBCAABBAABBAAACCBBCCABCBABCBBCCCA.exe" start= auto displayName= "UserDataSvc_CBCBBCCCBCCCBACBAABBCACCACCABBACBACACCBABBAABCBBACC"
  2⤵
  PID:2144
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBBCCCBCCCBACBAABBCACCACCABBACBACACCBABBAABCBBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCAABCCCACABBCACCABBCAABBAABBAAACCBBCCABCBABCBBCCCA.exe" start= auto displayName= "UserDataSvc_CBCBBCCCBCCCBACBAABBCACCACCABBACBACACCBABBAABCBBACC"
    3⤵
    PID:5588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBBCCCBCCCBACBAABBCACCACCABBACBACACCBABBAABCBBACC"
  2⤵
  PID:4744
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBBCCCBCCCBACBAABBCACCACCABBACBACACCBABBAABCBBACC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCAAABACBAACCABCACAACBAACCCACCACAAAAAAABAABBBBACBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCAAABACBAACCABCACAACBAACCCACCACAAAAAAABAABBBBACBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCACBAABCACCCCABABAACCCABCCBCBBACBAABCAACAABAACCCCBAABCACCABCAAACABCBBCCABABCACBBACBCAAABCAACAAACCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCAABACBACAABBACBBACAABCACBCABBACCBBBCCCCBAACBCBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCACBAABCACCCCABABAACCCABCCBCBBACBAABCAACAABAACCCCBAABCACCABCAAACABCBBCCABABCACBBACBCAAABCAACAAACCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCAABACBACAABBACBBACAABCACBCABBACCBBBCCCCBAACBCBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACAACBACACCCCBBBACCAAACBBCACACAABCBACAACBCBCCCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCAABACBACAABBACBBACAABCACBCABBACCBBBCCCCBAACBCBBAA.exe" start= auto displayName= "UserDataSvc_ABACAACBACACCCCBBBACCAAACBBCACACAABCBACAACBCBCCCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6864
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACAACBACACCCCBBBACCAAACBBCACACAABCBACAACBCBCCCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCAABACBACAABBACBBACAABCACBCABBACCBBBCCCCBAACBCBBAA.exe" start= auto displayName= "UserDataSvc_ABACAACBACACCCCBBBACCAAACBBCACACAABCBACAACBCBCCCCAA"
    3⤵
    - Launches sc.exe
    PID:6976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACAACBACACCCCBBBACCAAACBBCACACAABCBACAACBCBCCCCAA"
  2⤵
  - Executes a command shell one-liner
  PID:7104
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACAACBACACCCCBBBACCAAACBBCACACAABCBACAACBCBCCCCAA"
    3⤵
    - Launches sc.exe
    PID:2500

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCCBCBABCAABABABCCABCABABCBBAABBBBABABBACBCCBBBBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCCBCBABCAABABABCCABCABABCBBAABBBBABABBACBCCBBBBAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCAABCABCBACABACCCAACBBCBAACCBABCBABBCBCCCBCABBCCBCBBAABBACCACACBCBBCBACABCCABBBAABCAABACAABACBBACACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCAACACBBAACAABCBBBBBBBCCABCCCAACAAABBBBCCCACCCABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCAABCABCBACABACCCAACBBCBAACCBABCBABBCBCCCBCABBCCBCBBAABBACCACACBCBBCBACABCCABBBAABCAABACAABACBBACACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCAACACBBAACAABCBBBBBBBCCABCCCAACAAABBBBCCCACCCABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCCCABBCABAACBABCBBCABBBACAAAACCACCBCCBCCBBACACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCAACACBBAACAABCBBBBBBBCCABCCCAACAAABBBBCCCACCCABBB.exe" start= auto displayName= "UserDataSvc_BACCCCABBCABAACBABCBBCABBBACAAAACCACCBCCBCCBBACACBB"
  2⤵
  PID:6944
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCCCABBCABAACBABCBBCABBBACAAAACCACCBCCBCCBBACACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCAACACBBAACAABCBBBBBBBCCABCCCAACAAABBBBCCCACCCABBB.exe" start= auto displayName= "UserDataSvc_BACCCCABBCABAACBABCBBCABBBACAAAACCACCBCCBCCBBACACBB"
    3⤵
    - Launches sc.exe
    PID:5260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCCCABBCABAACBABCBBCABBBACAAAACCACCBCCBCCBBACACBB"
  2⤵
  - Executes a command shell one-liner
  PID:3212
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACCCCABBCABAACBABCBBCABBBACAAAACCACCBCCBCCBBACACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6264

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCAAABACBAACCABCACAACBAACCCACCACAAAAAAABAABBBBACBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCAAABACBAACCABCACAACBAACCCACCACAAAAAAABAABBBBACBBB.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBBBACBCBCBABBBACBCCAABBBBBABBBCCBCCBAACAACABAABBAABACBBCCCBCBBCBAACAABCBBBACABAACCCBCCBBBBACACBCCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABABBCCBCCCBCBBACACCBBCBCCAACBBCABBBBCBACCAABCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6308
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBBBACBCBCBABBBACBCCAABBBBBABBBCCBCCBAACAACABAABBAABACBBCCCBCBBCBAACAABCBBBACABAACCCBCCBBBBACACBCCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABABBCCBCCCBCBBACACCBBCBCCAACBBCABBBBCBACCAABCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCABCBBBBACABCCCACBABABCABCBBCAAAABABCBAACBCACBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABABBCCBCCCBCBBACACCBBCBCCAACBBCABBBBCBACCAABCCAC.exe" start= auto displayName= "UserDataSvc_ABCABCBBBBACABCCCACBABABCABCBBCAAAABABCBAACBCACBCCB"
  2⤵
  PID:6368
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCABCBBBBACABCCCACBABABCABCBBCAAAABABCBAACBCACBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABABBCCBCCCBCBBACACCBBCBCCAACBBCABBBBCBACCAABCCAC.exe" start= auto displayName= "UserDataSvc_ABCABCBBBBACABCCCACBABABCABCBBCAAAABABCBAACBCACBCCB"
    3⤵
    PID:6456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCABCBBBBACABCCCACBABABCABCBBCAAAABABCBAACBCACBCCB"
  2⤵
  - Executes a command shell one-liner
  PID:6564
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCABCBBBBACABCCCACBABABCABCBBCAAAABABCBAACBCACBCCB"
    3⤵
    PID:1308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCCBCBABCAABABABCCABCABABCBBAABBBBABABBACBCCBBBBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCCBCBABCAABABABCCABCABABCBBAABBBBABABBACBCCBBBBAAC.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCAAACAACBBCCCABABBBCCCAAAABBAABCCCCBCCBAABACCAACABCBBCBCACAABBACABCBAACCAABACBACACCABCCABCCCCBABACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCAAACAACBBCCCABABBBCCCAAAABBAABCCCCBCCBAABACCAACABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:6492
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCAAACAACBBCCCABABBBCCCAAAABBAABCCCCBCCBAABACCAACABCBBCBCACAABBACABCBAACCAABACBACACCABCCABCCCCBABACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCAAACAACBBCCCABABBBCCCAAAABBAABCCCCBCCBAABACCAACABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBBABAACCACACAAAABCBCBAAABCCCBCBAAABBAAAAAAABACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCAAACAACBBCCCABABBBCCCAAAABBAABCCCCBCCBAABACCAACABC.exe" start= auto displayName= "UserDataSvc_BACBBABAACCACACAAAABCBCBAAABCCCBCBAAABBAAAAAAABACCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2828
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBBABAACCACACAAAABCBCBAAABCCCBCBAAABBAAAAAAABACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCAAACAACBBCCCABABBBCCCAAAABBAABCCCCBCCBAABACCAACABC.exe" start= auto displayName= "UserDataSvc_BACBBABAACCACACAAAABCBCBAAABCCCBCBAAABBAAAAAAABACCB"
    3⤵
    - Launches sc.exe
    PID:6764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBBABAACCACACAAAABCBCBAAABCCCBCBAAABBAAAAAAABACCB"
  2⤵
  PID:6792
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBBABAACCACACAAAABCBCBAAABCCCBCBAAABBAAAAAAABACCB"
    3⤵
    - Launches sc.exe
    PID:2036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAABBBBABBCBCBCACAABBABBBBBCACACCBABCABCCBBABCCABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABAABBBBABBCBCBCACAABBABBBBBCACACCBABCABCCBBABCCABBAA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBABACBABCBCBBCBCBCBBCABABAAAAACABCABBCABCACCABCCBAAABACBAABBABCBABAABBBCACBBCBAABCBAAACACCBAACACAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBAABCCABCABAACBCACCCACCBCBBBCABCBCAAACCBCBCACBCACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:4184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBABACBABCBCBBCBCBCBBCABABAAAAACABCABBCABCACCABCCBAAABACBAABBABCBABAABBBCACBBCBAABCBAAACACCBAACACAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBAABCCABCABAACBCACCCACCBCBBBCABCBCAAACCBCBCACBCACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACACBACBCABBAACACCABCBCBCBCBCACCCACBBBBACABCCBACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBAABCCABCABAACBCACCCACCBCBBBCABCBCAAACCBCBCACBCACBA.exe" start= auto displayName= "UserDataSvc_ACACBACBCABBAACACCABCBCBCBCBCACCCACBBBBACABCCBACCBB"
  2⤵
  PID:4584
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACACBACBCABBAACACCABCBCBCBCBCACCCACBBBBACABCCBACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBAABCCABCABAACBCACCCACCBCBBBCABCBCAAACCBCBCACBCACBA.exe" start= auto displayName= "UserDataSvc_ACACBACBCABBAACACCABCBCBCBCBCACCCACBBBBACABCCBACCBB"
    3⤵
    - Launches sc.exe
    PID:2676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACACBACBCABBAACACCABCBCBCBCBCACCCACBBBBACABCCBACCBB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4088
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACACBACBCABBAACACCABCBCBCBCBCACCCACBBBBACABCCBACCBB"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAABCBACABBCCCCCBACCBABCABCBACABBACCBCBAABCCCBCBCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAABCBACABBCCCCCBACCBABCABCBACABBACCBCBAABCCCBCBCCBA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACACBBAACABBCCCBABBCACAAAACABBCACCCAABBBAACCCCBBBBCAACBBABCCACACCABABBBAAACBCBAACCACAAABCCBBACCABBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACACBBAACABBCCCBABBCACAAAACABBCACCCAABBBAACCCCBBBBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACACBBAACABBCCCBABBCACAAAACABBCACCCAABBBAACCCCBBBBCAACBBABCCACACCABABBBAAACBCBAACCACAAABCCBBACCABBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACACBBAACABBCCCBABBCACAAAACABBCACCCAABBBAACCCCBBBBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABCABAACACCCCCCBAACCABBCCBACBBCCBCBCACBACBCCBAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACACBBAACABBCCCBABBCACAAAACABBCACCCAABBBAACCCCBBBBCAA.exe" start= auto displayName= "UserDataSvc_CCABCABAACACCCCCCBAACCABBCCBACBBCCBCBCACBACBCCBAACC"
  2⤵
  - Executes a command shell one-liner
  PID:5708
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABCABAACACCCCCCBAACCABBCCBACBBCCBCBCACBACBCCBAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACACBBAACABBCCCBABBCACAAAACABBCACCCAABBBAACCCCBBBBCAA.exe" start= auto displayName= "UserDataSvc_CCABCABAACACCCCCCBAACCABBCCBACBBCCBCBCACBACBCCBAACC"
    3⤵
    PID:3856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABCABAACACCCCCCBAACCABBCCBACBBCCBCBCACBACBCCBAACC"
  2⤵
  - Executes a command shell one-liner
  PID:2932
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABCABAACACCCCCCBAACCABBCCBACBBCCBCBCACBACBCCBAACC"
    3⤵
    PID:2676

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBAABCCABCABAACBCACCCACCBCBBBCABCBCAAACCBCBCACBCACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBAABCCABCABAACBCACCCACCBCBBBCABCBCAAACCBCBCACBCACBA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABCACCBCACCBACBCACABBCBACBCCCCCAAAAACCABAABBBBCCACCCBBCBBBBAACCCCAAAABBBBAACCBCACCACAAACBCAAAACBAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBACCAACBAAAABBCCCACAACBBBBBCCBBACCCCAABCCAAAAAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABCACCBCACCBACBCACABBCBACBCCCCCAAAAACCABAABBBBCCACCCBBCBBBBAACCCCAAAABBBBAACCBCACCACAAACBCAAAACBAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBACCAACBAAAABBCCCACAACBBBBBCCBBACCCCAABCCAAAAAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCCBACABAABCCCCBCBCBACAAACACBBCAABBBACACCACACABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBACCAACBAAAABBCCCACAACBBBBBCCBBACCCCAABCCAAAAAAAAB.exe" start= auto displayName= "UserDataSvc_AABCCBACABAABCCCCBCBCBACAAACACBBCAABBBACACCACACABBB"
  2⤵
  PID:3444
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCCBACABAABCCCCBCBCBACAAACACBBCAABBBACACCACACABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBACCAACBAAAABBCCCACAACBBBBBCCBBACCCCAABCCAAAAAAAAB.exe" start= auto displayName= "UserDataSvc_AABCCBACABAABCCCCBCBCBACAAACACBBCAABBBACACCACACABBB"
    3⤵
    - Launches sc.exe
    PID:1200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCCBACABAABCCCCBCBCBACAAACACBBCAABBBACACCACACABBB"
  2⤵
  PID:3596
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCCBACABAABCCCCBCBCBACAAACACBBCAABBBACACCACACABBB"
    3⤵
    PID:248

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACACBBAACABBCCCBABBCACAAAACABBCACCCAABBBAACCCCBBBBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACACBBAACABBCCCBABBCACAAAACABBCACCCAABBBAACCCCBBBBCAA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCBABACAACAABCBBBCACCBCACBAABCBCCAACBBCBAABBCACBCABCCCCBCBAAABBBBABACBBABCAACBCCABACBBBAACBBBCCCCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCACACBCABBBCACCAACABBCCCABCBBBBBCABCCACCCCACBCCBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCBABACAACAABCBBBCACCBCACBAABCBCCAACBBCBAABBCACBCABCCCCBCBAAABBBBABACBBABCAACBCCABACBBBAACBBBCCCCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCACACBCABBBCACCAACABBCCCABCBBBBBCABCCACCCCACBCCBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAACABACBBACBBCBCAAABACBAACBACBBBACBACCCCCAABCBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCACACBCABBBCACCAACABBCCCABCBBBBBCABCCACCCCACBCCBCBB.exe" start= auto displayName= "UserDataSvc_CBAACABACBBACBBCBCAAABACBAACBACBBBACBACCCCCAABCBBAA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6412
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAACABACBBACBBCBCAAABACBAACBACBBBACBACCCCCAABCBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCACACBCABBBCACCAACABBCCCABCBBBBBCABCCACCCCACBCCBCBB.exe" start= auto displayName= "UserDataSvc_CBAACABACBBACBBCBCAAABACBAACBACBBBACBACCCCCAABCBBAA"
    3⤵
    - Launches sc.exe
    PID:6456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAACABACBBACBBCBCAAABACBAACBACBBBACBACCCCCAABCBBAA"
  2⤵
  PID:6476
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAACABACBBACBBCBCAAABACBAACBACBBBACBACCCCCAABCBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6524

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBCCCCBCABCBBABCBACABBCBBCABBCACCAAACABAACBAABCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBCCCCBCABCBBABCBACABBCBBCABBCACCAAACABAACBAABCCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABAAACBACACBACBACAAABCBBBBCCAABCACACBAAACACBCCBCAABCBCACCCABACCABAABBAABABABCABCACACACACCACCCBCACAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAAACBACACBACBACAAABCBBBBCCAABCACACBAAACACBCCBCAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:2752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABAAACBACACBACBACAAABCBBBBCCAABCACACBAAACACBCCBCAABCBCACCCABACCABAABBAABABABCABCACACACACCACCCBCACAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAAACBACACBACBACAAABCBBBBCCAABCACACBAAACACBCCBCAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABBACBCAAAAAABCBCACABCACCABCBABACBBBBACABAACABCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAAACBACACBACBACAAABCBBBBCCAABCACACBAAACACBCCBCAABCB.exe" start= auto displayName= "UserDataSvc_BBABBACBCAAAAAABCBCACABCACCABCBABACBBBBACABAACABCAA"
  2⤵
  PID:1456
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBABBACBCAAAAAABCBCACABCACCABCBABACBBBBACABAACABCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAAACBACACBACBACAAABCBBBBCCAABCACACBAAACACBCCBCAABCB.exe" start= auto displayName= "UserDataSvc_BBABBACBCAAAAAABCBCACABCACCABCBABACBBBBACABAACABCAA"
    3⤵
    - Launches sc.exe
    PID:2572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBABBACBCAAAAAABCBCACABCACCABCBABACBBBBACABAACABCAA"
  2⤵
  PID:4124
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBABBACBCAAAAAABCBCACABCACCABCBABACBBBBACABAACABCAA"
    3⤵
    PID:988

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABCCCACCABBCABAACCCCCABABABBCCCCBCCBAACACABAABCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABCCCACCABBCABAACCCCCABABABBCCCCBCCBAACACABAABCACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:5544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACBAABBBCABBACBBBACACCCCCABBBBABAACCCABAAACCBAACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3244
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACBAABBBCABBACBBBACACCCCCABBBBABAACCCABAAACCBAACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBAABCCBCBCBBBAACBCBCBBCBABBABCCAAAABABCCCABCBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACB.exe" start= auto displayName= "UserDataSvc_BCBBAABCCBCBCBBBAACBCBCBBCBABBABCCAAAABABCCCABCBCCB"
  2⤵
  PID:1704
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBAABCCBCBCBBBAACBCBCBBCBABBABCCAAAABABCCCABCBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACB.exe" start= auto displayName= "UserDataSvc_BCBBAABCCBCBCBBBAACBCBCBBCBABBABCCAAAABABCCCABCBCCB"
    3⤵
    PID:6320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBAABCCBCBCBBBAACBCBCBBCBABBABCCAAAABABCCCABCBCCB"
  2⤵
  - Executes a command shell one-liner
  PID:5464
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBAABCCBCBCBBBAACBCBCBBCBABBABCCAAAABABCCCABCBCCB"
    3⤵
    PID:6852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACACCABABBABBCAABBAACACAABCCCBACBBAABAACBBABABBCAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACACCABABBABBCAABBAACACAABCCCBACBBAABAACBBABABBCAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACBAABBBCABBACBBBACACCCCCABBBBABAACCCABAAACCBAACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACBAABBBCABBACBBBACACCCCCABBBBABAACCCABAAACCBAACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCABAACBBBBCBBBCBBBCBCCABAACAACCBCCACBCCCABCAABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACB.exe" start= auto displayName= "UserDataSvc_ACBCABAACBBBBCBBBCBBBCBCCABAACAACCBCCACBCCCABCAABBB"
  2⤵
  PID:6464
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCABAACBBBBCBBBCBBBCBCCABAACAACCBCCACBCCCABCAABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACB.exe" start= auto displayName= "UserDataSvc_ACBCABAACBBBBCBBBCBBBCBCCABAACAACCBCCACBCCCABCAABBB"
    3⤵
    PID:700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCABAACBBBBCBBBCBBBCBCCABAACAACCBCCACBCCCABCAABBB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4420
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCABAACBBBBCBBBCBBBCBCCABAACAACCBCCACBCCCABCAABBB"
    3⤵
    - Launches sc.exe
    PID:1260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACACCABABBABBCAABBAACACAABCCCBACBBAABAACBBABABBCAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACACCABABBABBCAABBAACACAABCCCBACBBAABAACBBABABBCAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBABACCCAAACBCCACABABACCABBAABCCACCCBABBCAACBACBCCBCBBBBBBCBABAACCCABBBBACCAACACCBAACCACAACAAAAAACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCCBBCABAABCCACACACACBABBBBBAAABACBBCBAAACBACCCCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBABACCCAAACBCCACABABACCABBAABCCACCCBABBCAACBACBCCBCBBBBBBCBABAACCCABBBBACCAACACCBAACCACAACAAAAAACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCCBBCABAABCCACACACACBABBBBBAAABACBBCBAAACBACCCCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAABCCACABBBABABBACCACCAACCAAAACCACBABCBCAAACCBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCCBBCABAABCCACACACACBABBBBBAAABACBBCBAAACBACCCCCBC.exe" start= auto displayName= "UserDataSvc_CCAABCCACABBBABABBACCACCAACCAAAACCACBABCBCAAACCBCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4652
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6320
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCAABCCACABBBABABBACCACCAACCAAAACCACBABCBCAAACCBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCCBBCABAABCCACACACACBABBBBBAAABACBBCBAAACBACCCCCBC.exe" start= auto displayName= "UserDataSvc_CCAABCCACABBBABABBACCACCAACCAAAACCACBABCBCAAACCBCCC"
    3⤵
    - Launches sc.exe
    PID:6416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAABCCACABBBABABBACCACCAACCAAAACCACBABCBCAAACCBCCC"
  2⤵
  PID:6428
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6408
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCAABCCACABBBABABBACCACCAACCAAAACCACBABCBCAAACCBCCC"
    3⤵
    PID:6692

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABCCCACCABBCABAACCCCCABABABBCCCCBCCBAACACABAABCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABCCCACCABBCABAACCCCCABABABBCCCCBCCBAACACABAABCACBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABABABBABABACACACCBBABABCACBACABCACACCCCBAAABACAABCCCCCCCBCBCABBCCACBABCBCCBCABABBBBCBCABCCBCBABCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACABCBCCABCBABCCBBAABCAABCBACCABAABBCBCBCCBABBCCABCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:5652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABABABBABABACACACCBBABABCACBACABCACACCCCBAAABACAABCCCCCCCBCBCABBCCACBABCBCCBCABABBBBCBCABCCBCBABCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACABCBCCABCBABCCBBAABCAABCBACCABAABBCBCBCCBABBCCABCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABABBBABBAAABBAAABBBBCACBACBACBCBACACBCBCAACBBCBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACABCBCCABCBABCCBBAABCAABCBACCABAABBCBCBCCBABBCCABCCC.exe" start= auto displayName= "UserDataSvc_ABABBBABBAAABBAAABBBBCACBACBACBCBACACBCBCAACBBCBACC"
  2⤵
  - Executes a command shell one-liner
  PID:5268
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABABBBABBAAABBAAABBBBCACBACBACBCBACACBCBCAACBBCBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACABCBCCABCBABCCBBAABCAABCBACCABAABBCBCBCCBABBCCABCCC.exe" start= auto displayName= "UserDataSvc_ABABBBABBAAABBAAABBBBCACBACBACBCBACACBCBCAACBBCBACC"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABABBBABBAAABBAAABBBBCACBACBACBCBACACBCBCAACBBCBACC"
  2⤵
  PID:5044
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABABBBABBAAABBAAABBBBCACBACBACBCBACACBCBCAACBBCBACC"
    3⤵
    - Launches sc.exe
    PID:2736

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCAABCCCACABBCACCABBCAABBAABBAAACCBBCCABCBABCBBCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCAABCCCACABBCACCABBCAABBAABBAAACCBBCCABCBABCBBCCCA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCBCACCBCABACCACABBAACBACAABCAAAAABCBBCACACABBAABCCCACCCBACCCBCACABBABCCCCBBBCBBAAAAAACAACCBBBBACBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACAABABBBCCBACBCBABCCCBCCCBCABCBCAAABCCAAACABCAAACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCBCACCBCABACCACABBAACBACAABCAAAAABCBBCACACABBAABCCCACCCBACCCBCACABBABCCCCBBBCBBAAAAAACAACCBBBBACBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACAABABBBCCBACBCBABCCCBCCCBCABCBCAAABCCAAACABCAAACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACAAAACCABCBAACCACAACCCBBABABABBCBABBBACCCCAACCCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACAABABBBCCBACBCBABCCCBCCCBCABCBCAAABCCAAACABCAAACBCA.exe" start= auto displayName= "UserDataSvc_ACAAAACCABCBAACCACAACCCBBABABABBCBABBBACCCCAACCCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:7248
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACAAAACCABCBAACCACAACCCBBABABABBCBABBBACCCCAACCCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACAABABBBCCBACBCBABCCCBCCCBCABCBCAAABCCAAACABCAAACBCA.exe" start= auto displayName= "UserDataSvc_ACAAAACCABCBAACCACAACCCBBABABABBCBABBBACCCCAACCCCCA"
    3⤵
    - Launches sc.exe
    PID:7344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACAAAACCABCBAACCACAACCCBBABABABBCBABBBACCCCAACCCCCA"
  2⤵
  PID:7396
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACAAAACCABCBAACCACAACCCBBABABABBCBABBBACCCCAACCCCCA"
    3⤵
    - Launches sc.exe
    PID:7492

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCAABCCCACABBCACCABBCAABBAABBAAACCBBCCABCBABCBBCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCAABCCCACABBCACCABBCAABBAABBAAACCBBCCABCBABCBBCCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCBCBCBCCBACBABBACAABCCCCCBCACAAABBCBCBCBABACAAAACCABABBBCBCCACAABCCBBBBAACCACCAABACABABCBBBBCBBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCCBBCAACACBBCACBCBACABCCACABABBBBABBABAAAABCBBAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:7112
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCBCBCBCCBACBABBACAABCCCCCBCACAAABBCBCBCBABACAAAACCABABBBCBCCACAABCCBBBBAACCACCAABACABABCBBBBCBBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCCBBCAACACBBCACBCBACABCCACABABBBBABBABAAAABCBBAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:7176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACCCBBABAABACBACCBCABCBBCACCABAAACCBBBACCCBBCACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCCBBCAACACBBCACBCBACABCCACABABBBBABBABAAAABCBBAACC.exe" start= auto displayName= "UserDataSvc_BCACCCBBABAABACBACCBCABCBBCACCABAAACCBBBACCCBBCACAB"
  2⤵
  PID:7300
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACCCBBABAABACBACCBCABCBBCACCABAAACCBBBACCCBBCACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCCBBCAACACBBCACBCBACABCCACABABBBBABBABAAAABCBBAACC.exe" start= auto displayName= "UserDataSvc_BCACCCBBABAABACBACCBCABCBBCACCABAAACCBBBACCCBBCACAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:7384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACCCBBABAABACBACCBCABCBBCACCABAAACCBBBACCCBBCACAB"
  2⤵
  PID:7468
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACCCBBABAABACBACCBCABCBBCACCABAAACCBBBACCCBBCACAB"
    3⤵
    - Launches sc.exe
    PID:7540

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBACCAACBAAAABBCCCACAACBBBBBCCBBACCCCAABCCAAAAAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBACCAACBAAAABBCCCACAACBBBBBCCBBACCCCAABCCAAAAAAAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:6156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCCBABBCCBAAAABBBACCACCAABABBBBBCABAAACAAACABABCAACBBBABBBAABABBBAAABACCBCAACBBBBBAACBBABCCBBCBCBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABBACACACACCBBAABBBACCAACBACBCABCBABBBBCCAACBACBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:5112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCCBABBCCBAAAABBBACCACCAABABBBBBCABAAACAAACABABCAACBBBABBBAABABBBAAABACCBCAACBBBBBAACBBABCCBBCBCBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABBACACACACCBBAABBBACCAACBACBCABCBABBBBCCAACBACBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACACACCCBCBBBBBBBCCACCAACBABAACCAABBACCCCBABACBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABBACACACACCBBAABBBACCAACBACBCABCBABBBBCCAACBACBCCB.exe" start= auto displayName= "UserDataSvc_ACACACCCBCBBBBBBBCCACCAACBABAACCAABBACCCCBABACBBBAA"
  2⤵
  - Executes a command shell one-liner
  PID:3068
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACACACCCBCBBBBBBBCCACCAACBABAACCAABBACCCCBABACBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABBACACACACCBBAABBBACCAACBACBCABCBABBBBCCAACBACBCCB.exe" start= auto displayName= "UserDataSvc_ACACACCCBCBBBBBBBCCACCAACBABAACCAABBACCCCBABACBBBAA"
    3⤵
    - Launches sc.exe
    PID:6700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACACACCCBCBBBBBBBCCACCAACBABAACCAABBACCCCBABACBBBAA"
  2⤵
  - Executes a command shell one-liner
  PID:6636
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACACACCCBCBBBBBBBCCACCAACBABAACCAABBACCCCBABACBBBAA"
    3⤵
    - Launches sc.exe
    PID:6980

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBACCAACBAAAABBCCCACAACBBBBBCCBBACCCCAABCCAAAAAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABBACCAACBAAAABBCCCACAACBBBBBCCBBACCCCAABCCAAAAAAAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBCBBCACBACAAAAABBCBCCBAAAAABACCACBABAAABCACACAACCBAABAACCCBCCBCAABCAABABCCCCACCACCCBBCCCCBBABBAACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABACCCCACAAAACBBBCBBCBBACCBAACAACBABCAAABBCCCCCBCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:6340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBCBBCACBACAAAAABBCBCCBAAAAABACCACBABAAABCACACAACCBAABAACCCBCCBCAABCAABABCCCCACCACCCBBCCCCBBABBAACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABACCCCACAAAACBBBCBBCBBACCBAACAACBABCAAABBCCCCCBCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCBABCCCBCCBACCAAABBACCCBCBBBCCCAAACBBACBBBACABAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABACCCCACAAAACBBBCBBCBBACCBAACAACBABCAAABBCCCCCBCBBB.exe" start= auto displayName= "UserDataSvc_CCCBABCCCBCCBACCAAABBACCCBCBBBCCCAAACBBACBBBACABAAB"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6348
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCBABCCCBCCBACCAAABBACCCBCBBBCCCAAACBBACBBBACABAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABACCCCACAAAACBBBCBBCBBACCBAACAACBABCAAABBCCCCCBCBBB.exe" start= auto displayName= "UserDataSvc_CCCBABCCCBCCBACCAAABBACCCBCBBBCCCAAACBBACBBBACABAAB"
    3⤵
    - Launches sc.exe
    PID:6696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCBABCCCBCCBACCAAABBACCCBCBBBCCCAAACBBACBBBACABAAB"
  2⤵
  PID:1868
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCBABCCCBCCBACCAAABBACCCBCBBBCCCAAACBBACBBBACABAAB"
    3⤵
    - Launches sc.exe
    PID:7096

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCACACBCABBBCACCAACABBCCCABCBBBBBCABCCACCCCACBCCBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCACACBCABBBCACCAACABBCCCABCBBBBBCABCCACCCCACBCCBCBB.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBBACBCABBBABACABCAABCBCCCBBCAACBAAAABAABABBCCCACABCAABCCAACABABBACBABCBCCCABABBACCACBCACBCCBBACABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCAACABACCCBCBAABBBBABACCACCBCABCCBAABCBBCBBACCABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6352
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBBACBCABBBABACABCAABCBCCCBBCAACBAAAABAABABBCCCACABCAABCCAACABABBACBABCBCCCABABBACCACBCACBCCBBACABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCAACABACCCBCBAABBBBABACCACCBCABCCBAABCBBCBBACCABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAABCBABCCCBBCACBBABBCAAACAACACBACBCCBCCCBCBBCAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCAACABACCCBCBAABBBBABACCACCBCABCCBAABCBBCBBACCABCAC.exe" start= auto displayName= "UserDataSvc_BAAABCBABCCCBBCACBBABBCAAACAACACBACBCCBCCCBCBBCAABA"
  2⤵
  PID:6404
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAAABCBABCCCBBCACBBABBCAAACAACACBACBCCBCCCBCBBCAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCAACABACCCBCBAABBBBABACCACCBCABCCBAABCBBCBBACCABCAC.exe" start= auto displayName= "UserDataSvc_BAAABCBABCCCBBCACBBABBCAAACAACACBACBCCBCCCBCBBCAABA"
    3⤵
    - Launches sc.exe
    PID:2824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAABCBABCCCBBCACBBABBCAAACAACACBACBCCBCCCBCBBCAABA"
  2⤵
  PID:704
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAAABCBABCCCBBCACBBABBCAAACAACACBACBCCBCCCBCBBCAABA"
    3⤵
    PID:6004

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCAABACBACAABBACBBACAABCACBCABBACCBBBCCCCBAACBCBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCAABACBACAABBACBBACAABCACBCABBACCBBBCCCCBAACBCBBAA.exe
1⤵
- Executes dropped EXE
PID:5460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAABAABCACBAACACACCBBCBAAABBACBCBCABABBBACCBCABCCBABBBBCCCABCBCCAABBAAACBACACABCABCBAACBBAACBBBBABACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBCBCCBCABCCBCCABABCCBCBBBACBACCCCBBBACBCBBBACCCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAABAABCACBAACACACCBBCBAAABBACBCBCABABBBACCBCABCCBABBBBCCCABCBCCAABBAAACBACACABCABCBAACBBAACBBBBABACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBCBCCBCABCCBCCABABCCBCBBBACBACCCCBBBACBCBBBACCCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABCAAACBABBCCBBBBABACAABBABBAACAAABBAAABCACABCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBCBCCBCABCCBCCABABCCBCBBBACBACCCCBBBACBCBBBACCCAAA.exe" start= auto displayName= "UserDataSvc_ACABCAAACBABBCCBBBBABACAABBABBAACAAABBAAABCACABCABB"
  2⤵
  PID:9472
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABCAAACBABBCCBBBBABACAABBABBAACAAABBAAABCACABCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBCBCCBCABCCBCCABABCCBCBBBACBACCCCBBBACBCBBBACCCAAA.exe" start= auto displayName= "UserDataSvc_ACABCAAACBABBCCBBBBABACAABBABBAACAAABBAAABCACABCABB"
    3⤵
    - Launches sc.exe
    PID:9856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABCAAACBABBCCBBBBABACAABBABBAACAAABBAAABCACABCABB"
  2⤵
  PID:10088
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABCAAACBABBCCBBBBABACAABBABBAACAAABBAAABCACABCABB"
    3⤵
    - Launches sc.exe
    PID:1344

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCAABACBACAABBACBBACAABCACBCABBACCBBBCCCCBAACBCBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCAABACBACAABBACBBACAABCACBCABBACCBBBCCCCBAACBCBBAA.exe
1⤵
- Executes dropped EXE
PID:5276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAACCAACAAABBABCCCCAABABCABCCBBCACBACCAAAACABCBBCACAACBCCCCCCCBABBCCABAACAACCBAAABCBAABCAACBACBCAABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABCBAAABAACACCBBCCBAACACBAACCAACACBABCAAACCBCCBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAACCAACAAABBABCCCCAABABCABCCBBCACBACCAAAACABCBBCACAACBCCCCCCCBABBCCABAACAACCBAAABCBAABCAACBACBCAABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABCBAAABAACACCBBCCBAACACBAACCAACACBABCAAACCBCCBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAACABAABACCBCBABACAAABABBCBCBCAAAAABBCCACCBABCAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABCBAAABAACACCBBCCBAACACBAACCAACACBABCAAACCBCCBCAB.exe" start= auto displayName= "UserDataSvc_AAACABAABACCBCBABACAAABABBCBCBCAAAAABBCCACCBABCAACA"
  2⤵
  - Executes a command shell one-liner
  PID:8516
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAACABAABACCBCBABACAAABABBCBCBCAAAAABBCCACCBABCAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABCBAAABAACACCBBCCBAACACBAACCAACACBABCAAACCBCCBCAB.exe" start= auto displayName= "UserDataSvc_AAACABAABACCBCBABACAAABABBCBCBCAAAAABBCCACCBABCAACA"
    3⤵
    PID:9372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAACABAABACCBCBABACAAABABBCBCBCAAAAABBCCACCBABCAACA"
  2⤵
  PID:9744
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAACABAABACCBCBABACAAABABBCBCBCAAAAABBCCACCBABCAACA"
    3⤵
    - Launches sc.exe
    PID:10004

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCAACACBBAACAABCBBBBBBBCCABCCCAACAAABBBBCCCACCCABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCAACACBBAACAABCBBBBBBBCCABCCCAACAAABBBBCCCACCCABBB.exe
1⤵
- Executes dropped EXE
PID:6224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBACCABAACACACAABBACACBBBAABBBCBACCBBBACACACBBBBACCACBBCABBBBAACACCCBCABBBCAACABBABCCBACBBAABCBAABACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCCBABAACABABBBACAACCAAABCBBBCCAACBAAAAACBAABCABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:8540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBACCABAACACACAABBACACBBBAABBBCBACCBBBACACACBBBBACCACBBCABBBBAACACCCBCABBBCAACABBABCCBACBBAABCBAABACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCCBABAACABABBBACAACCAAABCBBBCCAACBAAAAACBAABCABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABACACCAABABBABABCACCACBCACBAACABBCACCCBACACCBABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCCBABAACABABBBACAACCAAABCBBBCCAACBAAAAACBAABCABAAA.exe" start= auto displayName= "UserDataSvc_CABACACCAABABBABABCACCACBCACBAACABBCACCCBACACCBABCC"
  2⤵
  - Executes a command shell one-liner
  PID:9848
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABACACCAABABBABABCACCACBCACBAACABBCACCCBACACCBABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCCBABAACABABBBACAACCAAABCBBBCCAACBAAAAACBAABCABAAA.exe" start= auto displayName= "UserDataSvc_CABACACCAABABBABABCACCACBCACBAACABBCACCCBACACCBABCC"
    3⤵
    - Launches sc.exe
    PID:10056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABACACCAABABBABABCACCACBCACBAACABBCACCCBACACCBABCC"
  2⤵
  - Executes a command shell one-liner
  PID:10236
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABACACCAABABBABABCACCACBCACBAACABBCACCCBACACCBABCC"
    3⤵
    PID:6148

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCAACACBBAACAABCBBBBBBBCCABCCCAACAAABBBBCCCACCCABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCAACACBBAACAABCBBBBBBBCCABCCCAACAAABBBBCCCACCCABBB.exe
1⤵
- Executes dropped EXE
PID:6268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCCCCCACCBCCCCAACABCCCBCACBCBACBBBCABCBABAABACCACAAABBCAABAAABCBCCAABACAAABAAABBBCBACCACBAABBACCBBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCCACCBCCCCAACABCCCBCACBCBACBBBCABCBABAABACCACAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCCCCCACCBCCCCAACABCCCBCACBCBACBBBCABCBABAABACCACAAABBCAABAAABCBCCAABACAAABAAABBBCBACCACBAABBACCBBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCCACCBCCCCAACABCCCBCACBCBACBBBCABCBABAABACCACAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCBCBCACCAABBCACAACACACABCBAABABAAAAACCCBBACAACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCCACCBCCCCAACABCCCBCACBCBACBBBCABCBABAABACCACAAAB.exe" start= auto displayName= "UserDataSvc_BBCBCBCACCAABBCACAACACACABCBAABABAAAAACCCBBACAACBAA"
  2⤵
  - Executes a command shell one-liner
  PID:9948
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCBCBCACCAABBCACAACACACABCBAABABAAAAACCCBBACAACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCCACCBCCCCAACABCCCBCACBCBACBBBCABCBABAABACCACAAAB.exe" start= auto displayName= "UserDataSvc_BBCBCBCACCAABBCACAACACACABCBAABABAAAAACCCBBACAACBAA"
    3⤵
    - Launches sc.exe
    PID:10224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCBCBCACCAABBCACAACACACABCBAABABAAAAACCCBBACAACBAA"
  2⤵
  - Executes a command shell one-liner
  PID:9428
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCBCBCACCAABBCACAACACACABCBAABABAAAAACCCBBACAACBAA"
    3⤵
    PID:9740

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABABBCCBCCCBCBBACACCBBCBCCAACBBCABBBBCBACCAABCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABABBCCBCCCBCBBACACCBBCBCCAACBBCABBBBCBACCAABCCAC.exe
1⤵
- Executes dropped EXE
PID:6716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBCBCACBBBCACBAAAACABCABACBBCAABCCAABCBABCCACBABBACBCBCBBABCBCBBBCCABBBCCCBACBBACABBACABCACCBCCBACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBBABBBBCABACACBBABACABACCCAAAABBBABCABCCCAACCBACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBCBCACBBBCACBAAAACABCABACBBCAABCCAABCBABCCACBABBACBCBCBBABCBCBBBCCABBBCCCBACBBACABBACABCACCBCCBACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBBABBBBCABACACBBABACABACCCAAAABBBABCABCCCAACCBACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAABAAABCABBBBCABAACBABAACCCCAAAACBAAAACCABBCBAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBBABBBBCABACACBBABACABACCCAAAABBBABCABCCCAACCBACAB.exe" start= auto displayName= "UserDataSvc_CAAABAAABCABBBBCABAACBABAACCCCAAAACBAAAACCABBCBAABB"
  2⤵
  - Executes a command shell one-liner
  PID:9856
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAABAAABCABBBBCABAACBABAACCCCAAAACBAAAACCABBCBAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBBABBBBCABACACBBABACABACCCAAAABBBABCABCCCAACCBACAB.exe" start= auto displayName= "UserDataSvc_CAAABAAABCABBBBCABAACBABAACCCCAAAACBAAAACCABBCBAABB"
    3⤵
    - Launches sc.exe
    PID:9484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAABAAABCABBBBCABAACBABAACCCCAAAACBAAAACCABBCBAABB"
  2⤵
  PID:9440
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAABAAABCABBBBCABAACBABAACCCCAAAACBAAAACCABBCBAABB"
    3⤵
    - Launches sc.exe
    PID:9500

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCAAACAACBBCCCABABBBCCCAAAABBAABCCCCBCCBAABACCAACABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCAAACAACBBCCCABABBBCCCAAAABBAABCCCCBCCBAABACCAACABC.exe
1⤵
- Executes dropped EXE
PID:6740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBBACABAABBAACCBAABAACABABCBAABCBBCCACABBBAAAAABCBBCCBBACCACAABCBCCCAACCACCAACAACBAABBCCBCBBABCCABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBACABAABBAACCBAABAACABABCBAABCBBCCACABBBAAAAABCBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:3152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBBACABAABBAACCBAABAACABABCBAABCBBCCACABBBAAAAABCBBCCBBACCACAABCBCCCAACCACCAACAACBAABBCCBCBBABCCABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBACABAABBAACCBAABAACABABCBAABCBBCCACABBBAAAAABCBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:1716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCAACAACBBCAACACBCAACCCABCAAACBBCAACAABCBCCBCBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBACABAABBAACCBAABAACABABCBAABCBBCCACABBBAAAAABCBBCC.exe" start= auto displayName= "UserDataSvc_BCBCAACAACBBCAACACBCAACCCABCAAACBBCAACAABCBCCBCBAAB"
  2⤵
  PID:2500
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCAACAACBBCAACACBCAACCCABCAAACBBCAACAABCBCCBCBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBACABAABBAACCBAABAACABABCBAABCBBCCACABBBAAAAABCBBCC.exe" start= auto displayName= "UserDataSvc_BCBCAACAACBBCAACACBCAACCCABCAAACBBCAACAABCBCCBCBAAB"
    3⤵
    PID:9828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCAACAACBBCAACACBCAACCCABCAAACBBCAACAABCBCCBCBAAB"
  2⤵
  PID:3016
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCAACAACBBCAACACBCAACCCABCAAACBBCAACAABCBCCBCBAAB"
    3⤵
    PID:8408

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCAAACAACBBCCCABABBBCCCAAAABBAABCCCCBCCBAABACCAACABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCAAACAACBBCCCABABBBCCCAAAABBAABCCCCBCCBAABACCAACABC.exe
1⤵
- Executes dropped EXE
PID:6736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABCBCCCABCBACABACACBABBBBACBBBAAABBABBACCBAAAAACAACAAAAACCACCCCACBBBCBCCCCABBBABABBABAABCAABBCAABCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCBCCCABCBACABACACBABBBBACBBBAAABBABBACCBAAAAACAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:10224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABCBCCCABCBACABACACBABBBBACBBBAAABBABBACCBAAAAACAACAAAAACCACCCCACBBBCBCCCCABBBABABBABAABCAABBCAABCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCBCCCABCBACABACACBABBBBACBBBAAABBABBACCBAAAAACAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAABBABBABABACCBBACCACCCABCAACCBCAAABCBCCCACCAAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCBCCCABCBACABACACBABBBBACBBBAAABBABBACCBAAAAACAACA.exe" start= auto displayName= "UserDataSvc_CBAABBABBABABACCBBACCACCCABCAACCBCAAABCBCCCACCAAABC"
  2⤵
  - Executes a command shell one-liner
  PID:9892
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAABBABBABABACCBBACCACCCABCAACCBCAAABCBCCCACCAAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCBCCCABCBACABACACBABBBBACBBBAAABBABBACCBAAAAACAACA.exe" start= auto displayName= "UserDataSvc_CBAABBABBABABACCBBACCACCCABCAACCBCAAABCBCCCACCAAABC"
    3⤵
    PID:9616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAABBABBABABACCBBACCACCCABCAACCBCAAABCBCCCACCAAABC"
  2⤵
  - Executes a command shell one-liner
  PID:5236
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAABBABBABABACCBBACCACCCABCAACCBCAAABCBCCCACCAAABC"
    3⤵
    - Launches sc.exe
    PID:4048

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABACCCCACAAAACBBBCBBCBBACCBAACAACBABCAAABBCCCCCBCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABACCCCACAAAACBBBCBBCBBACCBAACAACBABCAAABBCCCCCBCBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBCAACACABCACCABBAABCABABCCCABACAAABCCBBCACBBAAACCAAAACCABCBABCCCCAAABBAABBBACCBACABBBBAABABACCBBCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCAACACABCACCABBAABCABABCCCABACAAABCCBBCACBBAAACCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBCAACACABCACCABBAABCABABCCCABACAAABCCBBCACBBAAACCAAAACCABCBABCCCCAAABBAABBBACCBACABBBBAABABACCBBCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCAACACABCACCABBAABCABABCCCABACAAABCCBBCACBBAAACCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBBBBCAAAABCABBBCABACBACBAABCBACCAABCCBBAAAACAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCAACACABCACCABBAABCABABCCCABACAAABCCBBCACBBAAACCAAA.exe" start= auto displayName= "UserDataSvc_CACBBBBCAAAABCABBBCABACBACBAABCBACCAABCCBBAAAACAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:8068
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBBBBCAAAABCABBBCABACBACBAABCBACCAABCCBBAAAACAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCAACACABCACCABBAABCABABCCCABACAAABCCBBCACBBAAACCAAA.exe" start= auto displayName= "UserDataSvc_CACBBBBCAAAABCABBBCABACBACBAABCBACCAABCCBBAAAACAACC"
    3⤵
    PID:1796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBBBBCAAAABCABBBCABACBACBAABCBACCAABCCBBAAAACAACC"
  2⤵
  PID:7756
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACBBBBCAAAABCABBBCABACBACBAABCBACCAABCCBBAAAACAACC"
    3⤵
    - Launches sc.exe
    PID:8012

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABACCCCACAAAACBBBCBBCBBACCBAACAACBABCAAABBCCCCCBCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABACCCCACAAAACBBBCBBCBBACCBAACAACBABCAAABBCCCCCBCBBB.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCABBCCAAABACAACCCBABCABBBCBAACBCCCCBACCABAAABBACAAACACACAABBBCAACBBBCCAABCBCCBCBACBACBCCBABAACABCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCABBCCAAABACAACCCBABCABBBCBAACBCCCCBACCABAAABBACAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:7736
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCABBCCAAABACAACCCBABCABBBCBAACBCCCCBACCABAAABBACAAACACACAABBBCAACBBBCCAABCBCCBCBACBACBCCBABAACABCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCABBCCAAABACAACCCBABCABBBCBAACBCCCCBACCABAAABBACAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBBCBCCABCCCBBBBABACBACCBBACCCBCBCCCCABBCBCBCBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCABBCCAAABACAACCCBABCABBBCBAACBCCCCBACCABAAABBACAAAC.exe" start= auto displayName= "UserDataSvc_CBCBBCBCCABCCCBBBBABACBACCBBACCCBCBCCCCABBCBCBCBBCC"
  2⤵
  - Executes a command shell one-liner
  PID:7180
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBBCBCCABCCCBBBBABACBACCBBACCCBCBCCCCABBCBCBCBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCABBCCAAABACAACCCBABCABBBCBAACBCCCCBACCABAAABBACAAAC.exe" start= auto displayName= "UserDataSvc_CBCBBCBCCABCCCBBBBABACBACCBBACCCBCBCCCCABBCBCBCBBCC"
    3⤵
    PID:7728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBBCBCCABCCCBBBBABACBACCBBACCCBCBCCCCABBCBCBCBBCC"
  2⤵
  PID:8052
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBBCBCCABCCCBBBBABACBACCBBACCCBCBCCCCABBCBCBCBBCC"
    3⤵
    - Launches sc.exe
    PID:7840

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABBACACACACCBBAABBBACCAACBACBCABCBABBBBCCAACBACBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABBACACACACCBBAABBBACCAACBACBCABCBABBBBCCAACBACBCCB.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBABAAABACACAACCBBBAAAABBBBCCABACACBACABCACACBBCBCBAACCACBCCBABBBAACCAABBAABBACBCBAABBACBAABABBCCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBAABCCACAACBACCABBBACABACCBBCBBBAAACAACBCBBCACCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:7804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBABAAABACACAACCBBBAAAABBBBCCABACACBACABCACACBBCBCBAACCACBCCBABBBAACCAABBAABBACBCBAABBACBAABABBCCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBAABCCACAACBACCABBBACABACCBBCBBBAAACAACBCBBCACCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:7988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAACBCBCBBACAAABBCBCCAACAAACAAABCCAABCBCABBCACBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBAABCCACAACBACCABBBACABACCBBCBBBAAACAACBCBBCACCCAC.exe" start= auto displayName= "UserDataSvc_CAAACBCBCBBACAAABBCBCCAACAAACAAABCCAABCBCABBCACBABA"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8140
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAACBCBCBBACAAABBCBCCAACAAACAAABCCAABCBCABBCACBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBAABCCACAACBACCABBBACABACCBBCBBBAAACAACBCBBCACCCAC.exe" start= auto displayName= "UserDataSvc_CAAACBCBCBBACAAABBCBCCAACAAACAAABCCAABCBCABBCACBABA"
    3⤵
    - Launches sc.exe
    PID:7596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAACBCBCBBACAAABBCBCCAACAAACAAABCCAABCBCABBCACBABA"
  2⤵
  - Executes a command shell one-liner
  PID:7624
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAACBCBCBBACAAABBCBCCAACAAACAAABCCAABCBCABBCACBABA"
    3⤵
    - Launches sc.exe
    PID:7768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABBACACACACCBBAABBBACCAACBACBCABCBABBBBCCAACBACBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABBACACACACCBBAABBBACCAACBACBCABCBABBBBCCAACBACBCCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:4940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBCCBACABAABCABAAAACCCABBBBAABAABBAAACBCACAAAAABACAACBCACABCACBBBCAAABBCBABABABBBBCAABBAABABCCCAACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCAAABCACCCACAACCBAACCACCCCBBCAAABCCACABACBABCBBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:7900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBCCBACABAABCABAAAACCCABBBBAABAABBAAACBCACAAAAABACAACBCACABCACBBBCAAABBCBABABABBBBCAABBAABABCCCAACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCAAABCACCCACAACCBAACCACCCCBBCAAABCCACABACBABCBBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBAAAABABCBAAAAAABBABACABACCCBCCAACBCCABBACCBAACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCAAABCACCCACAACCBAACCACCCCBBCAAABCCACABACBABCBBCBB.exe" start= auto displayName= "UserDataSvc_BCBAAAABABCBAAAAAABBABACABACCCBCCAACBCCABBACCBAACAA"
  2⤵
  PID:8172
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBAAAABABCBAAAAAABBABACABACCCBCCAACBCCABBACCBAACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCAAABCACCCACAACCBAACCACCCCBBCAAABCCACABACBABCBBCBB.exe" start= auto displayName= "UserDataSvc_BCBAAAABABCBAAAAAABBABACABACCCBCCAACBCCABBACCBAACAA"
    3⤵
    - Launches sc.exe
    PID:7600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBAAAABABCBAAAAAABBABACABACCCBCCAACBCCABBACCBAACAA"
  2⤵
  PID:2992
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBAAAABABCBAAAAAABBABACABACCCBCCAACBCCABBACCBAACAA"
    3⤵
    - Launches sc.exe
    PID:7972

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAAACBACACBACBACAAABCBBBBCCAABCACACBAAACACBCCBCAABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAAACBACACBACBACAAABCBBBBCCAABCACACBAAACACBCCBCAABCB.exe
1⤵
- Executes dropped EXE
PID:6304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABCABAAAABCBCACCAABBAACAACCBABCCCCBACAACCABACBAAABAAAACCBCBCBBBCBBBBAABBBCCBABBCBAAAAABBACBAABACAAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABAAAABCBCACCAABBAACAACCBABCCCCBACAACCABACBAAABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABCABAAAABCBCACCAABBAACAACCBABCCCCBACAACCABACBAAABAAAACCBCBCBBBCBBBBAABBBCCBABBCBAAAAABBACBAABACAAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABAAAABCBCACCAABBAACAACCBABCCCCBACAACCABACBAAABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAABBBCCCCCCCABACCACCCACCBCBBCABACBBBCCABBBABACCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABAAAABCBCACCAABBAACAACCBABCCCCBACAACCABACBAAABAAA.exe" start= auto displayName= "UserDataSvc_ABAABBBCCCCCCCABACCACCCACCBCBBCABACBBBCCABBBABACCAC"
  2⤵
  - Executes a command shell one-liner
  PID:7952
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAABBBCCCCCCCABACCACCCACCBCBBCABACBBBCCABBBABACCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABAAAABCBCACCAABBAACAACCBABCCCCBACAACCABACBAAABAAA.exe" start= auto displayName= "UserDataSvc_ABAABBBCCCCCCCABACCACCCACCBCBBCABACBBBCCABBBABACCAC"
    3⤵
    - Launches sc.exe
    PID:8164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAABBBCCCCCCCABACCACCCACCBCBBCABACBBBCCABBBABACCAC"
  2⤵
  PID:7184
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABAABBBCCCCCCCABACCACCCACCBCBBCABACBBBCCABBBABACCAC"
    3⤵
    PID:2324

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCAACABACCCBCBAABBBBABACCACCBCABCCBAABCBBCBBACCABCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCAACABACCCBCBAABBBBABACCACCBCABCCBAABCBBCBBACCABCAC.exe
1⤵
- Executes dropped EXE
PID:5156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACBBBBABCBCCCCBABABAACBBCABACCBBABCABBCBBBCACCACCBAAABCCACACCBBCCACABAAAAABACCACABCAABCABAABBBBCCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCABBCBACCCBCBAABBCBBCCCBBABBBBCBBBAAAABACBCABBACCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:9088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACBBBBABCBCCCCBABABAACBBCABACCBBABCABBCBBBCACCACCBAAABCCACACCBBCCACABAAAAABACCACABCAABCABAABBBBCCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCABBCBACCCBCBAABBCBBCCCBBABBBBCBBBAAAABACBCABBACCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCACBAABCABACCBAABCABAACBBACACAACCCBABACCCBBBBCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCABBCBACCCBCBAABBCBBCCCBBABBBBCBBBAAAABACBCABBACCCAC.exe" start= auto displayName= "UserDataSvc_CBCACBAABCABACCBAABCABAACBBACACAACCCBABACCCBBBBCACB"
  2⤵
  PID:9436
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCACBAABCABACCBAABCABAACBBACACAACCCBABACCCBBBBCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCABBCBACCCBCBAABBCBBCCCBBABBBBCBBBAAAABACBCABBACCCAC.exe" start= auto displayName= "UserDataSvc_CBCACBAABCABACCBAABCABAACBBACACAACCCBABACCCBBBBCACB"
    3⤵
    PID:9824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCACBAABCABACCBAABCABAACBBACACAACCCBABACCCBBBBCACB"
  2⤵
  - Executes a command shell one-liner
  PID:10068
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCACBAABCABACCBAABCABAACBBACACAACCCBABACCCBBBBCACB"
    3⤵
    - Launches sc.exe
    PID:9392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACB.exe
1⤵
- Executes dropped EXE
PID:6356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBBBCAAABBBCCACAABCBCBCBAABCCBBACACCAACCBACBCCBBAABBCBCACACACCCAACBACAABCCCAABCCBCABAACCABBBBAACCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABABBCBBCACABCAABAABCBBABACABCBAACACABACBBBCBCBCACCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:7156
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBBBCAAABBBCCACAABCBCBCBAABCCBBACACCAACCBACBCCBBAABBCBCACACACCCAACBACAABCCCAABCCBCABAACCABBBBAACCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABABBCBBCACABCAABAABCBBABACABCBAACACABACBBBCBCBCACCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAACACBBCCBCCBBAACABBCBBBBAABBCBCABCCACBACCBACCCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABABBCBBCACABCAABAABCBBABACABCBAACACABACBBBCBCBCACCCC.exe" start= auto displayName= "UserDataSvc_AAACACBBCCBCCBBAACABBCBBBBAABBCBCABCCACBACCBACCCCAB"
  2⤵
  - Executes a command shell one-liner
  PID:9376
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAACACBBCCBCCBBAACABBCBBBBAABBCBCABCCACBACCBACCCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABABBCBBCACABCAABAABCBBABACABCBAACACABACBBBCBCBCACCCC.exe" start= auto displayName= "UserDataSvc_AAACACBBCCBCCBBAACABBCBBBBAABBCBCABCCACBACCBACCCCAB"
    3⤵
    - Launches sc.exe
    PID:10360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAACACBBCCBCCBBAACABBCBBBBAABBCBCABCCACBACCBACCCCAB"
  2⤵
  PID:10668
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAACACBBCCBCCBBAACABBCBBBBAABBCBCABCCACBACCBACCCCAB"
    3⤵
    - Launches sc.exe
    PID:6500

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABAAACCBABACACBCBBCABCACBCAACCBBBBCCCAABBCAABBAACB.exe
1⤵
- Executes dropped EXE
PID:6360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBCCAAABBAABACBCAACBCCACBAABCACBAACCBCBABBBABBCCBAACCCCABBABCCCBACABBBCAACACBABCAABCBCBBBCCBBCCBCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACBBCBCBCBBCBABCBBAABABCBCCCABCCCCCBCBABACABABCAACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:1308
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBCCAAABBAABACBCAACBCCACBAABCACBAACCBCBABBBABBCCBAACCCCABBABCCCBACABBBCAACACBABCAABCBCBBBCCBBCCBCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACBBCBCBCBBCBABCBBAABABCBCCCABCCCCCBCBABACABABCAACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACACCCBCBBCBBCCACACBCACBCABAAACCCCABABCBBBBCCABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACBBCBCBCBBCBABCBBAABABCBCCCABCCCCCBCBABACABABCAACBC.exe" start= auto displayName= "UserDataSvc_BACACCCBCBBCBBCCACACBCACBCABAAACCCCABABCBBBBCCABBCC"
  2⤵
  PID:6560
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACACCCBCBBCBBCCACACBCACBCABAAACCCCABABCBBBBCCABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACBBCBCBCBBCBABCBBAABABCBCCCABCCCCCBCBABACABABCAACBC.exe" start= auto displayName= "UserDataSvc_BACACCCBCBBCBBCCACACBCACBCABAAACCCCABABCBBBBCCABBCC"
    3⤵
    PID:10384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACACCCBCBBCBBCCACACBCACBCABAAACCCCABABCBBBBCCABBCC"
  2⤵
  PID:10732
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACACCCBCBBCBBCCACACBCACBCABAAACCCCABABCBBBBCCABBCC"
    3⤵
    - Launches sc.exe
    PID:10532

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCCBBCABAABCCACACACACBABBBBBAAABACBBCBAAACBACCCCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCCBBCABAABCCACACACACBABBBBBAAABACBBCBAAACBACCCCCBC.exe
1⤵
- Executes dropped EXE
PID:5272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCAACCABBBCBCBACCCBAAACAAABAABACBCACCBACCCCCBBBBCBCBBCACACCBAACAAACCAAACABBCACBBCBBCCBBCAABAACAACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBABBCAACABACCCBAAABBAABBABAACCAAAABCCABCBCBAABBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:10684

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACABCBCCABCBABCCBBAABCAABCBACCABAABBCBCBCCBABBCCABCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACABCBCCABCBABCCBBAABCAABCBACCABAABBCBCBCCBABBCCABCCC.exe
1⤵
- Executes dropped EXE
PID:6748

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACABCBCCABCBABCCBBAABCAABCBACCABAABBCBCBCCBABBCCABCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACABCBCCABCBABCCBBAABCAABCBACCABAABBCBCBCCBABBCCABCCC.exe
1⤵
- Executes dropped EXE
PID:1852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCCBBCAACACBBCACBCBACABCCACABABBBBABBABAAAABCBBAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCCBBCAACACBBCACBCBACABCCACABABBBBABBABAAAABCBBAACC.exe
1⤵
- Executes dropped EXE
PID:7420

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCCBBCAACACBBCACBCBACABCCACABABBBBABBABAAAABCBBAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCCBBCAACACBBCACBCBACABCCACABABBBBABBABAAAABCBBAACC.exe
1⤵
- Executes dropped EXE
PID:7560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCABBCBABABAABAAAABBBACACBBBAABBCCBCBACCBABAAABBCBBBBBACCBCBAAAAABABABAABABAACBCBAAAACACCBAABBCBACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBCBABABAABAAAABBBACACBBBAABBCCBCBACCBABAAABBCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCABBCBABABAABAAAABBBACACBBBAABBCCBCBACCBABAAABBCBBBBBACCBCBAAAAABABABAABABAACBCBAAAACACCBAABBCBACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBCBABABAABAAAABBBACACBBBAABBCCBCBACCBABAAABBCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAABACCBBBABBABACCCBCCCAACCBBBBCBABCBAACACACBCCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBCBABABAABAAAABBBACACBBBAABBCCBCBACCBABAAABBCBBBB.exe" start= auto displayName= "UserDataSvc_CAAABACCBBBABBABACCCBCCCAACCBBBBCBABCBAACACACBCCBCC"
  2⤵
  PID:8152
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAABACCBBBABBABACCCBCCCAACCBBBBCBABCBAACACACBCCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBCBABABAABAAAABBBACACBBBAABBCCBCBACCBABAAABBCBBBB.exe" start= auto displayName= "UserDataSvc_CAAABACCBBBABBABACCCBCCCAACCBBBBCBABCBAACACACBCCBCC"
    3⤵
    PID:8108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAABACCBBBABBABACCCBCCCAACCBBBBCBABCBAACACACBCCBCC"
  2⤵
  PID:6952
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7176
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAABACCBBBABBABACCCBCCCAACCBBBBCBABCBAACACACBCCBCC"
    3⤵
    PID:7896

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACAABABBBCCBACBCBABCCCBCCCBCABCBCAAABCCAAACABCAAACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACAABABBBCCBACBCBABCCCBCCCBCABCBCAAABCCAAACABCAAACBCA.exe
1⤵
- Executes dropped EXE
PID:7576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBCAABBBACCCBCBAABBCCBBACABCCBAAABCACABBCBCCBBBBABCCBACCBBCABBCCBBACCABCACCBAABCCACACABCBCBCBACCCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBBCBAAACCCBCBCCBCAACBCCABACACCAAAACBCCACABABBBABBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8188
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBCAABBBACCCBCBAABBCCBBACABCCBAAABCACABBCBCCBBBBABCCBACCBBCABBCCBBACCABCACCBAABCCACACABCBCBCBACCCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBBCBAAACCCBCBCCBCAACBCCABACACCAAAACBCCACABABBBABBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABAAABACBCBBCAACBBACCCBCBCAACCCACAABAABBABCAACBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBBCBAAACCCBCBCCBCAACBCCABACACCAAAACBCCACABABBBABBBC.exe" start= auto displayName= "UserDataSvc_BAABAAABACBCBBCAACBBACCCBCBCAACCCACAABAABBABCAACBAC"
  2⤵
  PID:8264
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABAAABACBCBBCAACBBACCCBCBCAACCCACAABAABBABCAACBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBBCBAAACCCBCBCCBCAACBCCABACACCAAAACBCCACABABBBABBBC.exe" start= auto displayName= "UserDataSvc_BAABAAABACBCBBCAACBBACCCBCBCAACCCACAABAABBABCAACBAC"
    3⤵
    PID:8312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABAAABACBCBBCAACBBACCCBCBCAACCCACAABAABBABCAACBAC"
  2⤵
  PID:8336
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABAAABACBCBBCAACBBACCCBCBCAACCCACAABAABBABCAACBAC"
    3⤵
    PID:8380

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCAACACABCACCABBAABCABABCCCABACAAABCCBBCACBBAAACCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCAACACABCACCABBAABCABABCCCABACAAABCCBBCACBBAAACCAAA.exe
1⤵
- Executes dropped EXE
PID:8112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCABCBBABBACBBAAABCBBBBCABCAAABBABBCAABABBAACCACCABBABBABCBABBCBACCBBBACABCACBACBCBBAAACCCCBBCABABCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCABCBBABBACBBAAABCBBBBCABCAAABBABBCAABABBAACCACCABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCABCBBABBACBBAAABCBBBBCABCAAABBABBCAABABBAACCACCABBABBABCBABBCBACCBBBACABCACBACBCBBAAACCCCBBCABABCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCABCBBABBACBBAAABCBBBBCABCAAABBABBCAABABBAACCACCABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAACBBBABCAABCCCCBCAAAAABCABBACAAABCBBCCBABACBCAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCABCBBABBACBBAAABCBBBBCABCAAABBABBCAABABBAACCACCABBA.exe" start= auto displayName= "UserDataSvc_AAACBBBABCAABCCCCBCAAAAABCABBACAAABCBBCCBABACBCAAAA"
  2⤵
  - Executes a command shell one-liner
  PID:8884
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAACBBBABCAABCCCCBCAAAAABCABBACAAABCBBCCBABACBCAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCABCBBABBACBBAAABCBBBBCABCAAABBABBCAABABBAACCACCABBA.exe" start= auto displayName= "UserDataSvc_AAACBBBABCAABCCCCBCAAAAABCABBACAAABCBBCCBABACBCAAAA"
    3⤵
    PID:8536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAACBBBABCAABCCCCBCAAAAABCABBACAAABCBBCCBABACBCAAAA"
  2⤵
  PID:5904
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAACBBBABCAABCCCCBCAAAAABCABBACAAABCBBCCBABACBCAAAA"
    3⤵
    - Launches sc.exe
    PID:9600

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:7344

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCAAABCACCCACAACCBAACCACCCCBBCAAABCCACABACBABCBBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCAAABCACCCACAACCBAACCACCCCBBCAAABCCACABACBABCBBCBB.exe
1⤵
PID:8048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAABABCCACCBCBABCCACAABABACCAAABACACCCACCBACABBCABCAACCACCBACBCBACACABCACACCCBCBCCABACAABABCCCAACBAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAACBCBACAABABACBCCAACACCBAACAACCBABCBABBBBBBABBBBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8676
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAABABCCACCBCBABCCACAABABACCAAABACACCCACCBACABBCABCAACCACCBACBCBACACABCACACCCBCBCCABACAABABCCCAACBAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAACBCBACAABABACBCCAACACCBAACAACCBABCBABBBBBBABBBBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBABBACBCABCAACCBAABABCBABBAAABBABCAABCACABCBABACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAACBCBACAABABACBCCAACACCBAACAACCBABCBABBBBBBABBBBBCA.exe" start= auto displayName= "UserDataSvc_ACBABBACBCABCAACCBAABABCBABBAAABBABCAABCACABCBABACA"
  2⤵
  PID:8760
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBABBACBCABCAACCBAABABCBABBAAABBABCAABCACABCBABACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAACBCBACAABABACBCCAACACCBAACAACCBABCBABBBBBBABBBBBCA.exe" start= auto displayName= "UserDataSvc_ACBABBACBCABCAACCBAABABCBABBAAABBABCAABCACABCBABACA"
    3⤵
    PID:8812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBABBACBCABCAACCBAABABCBABBAAABBABCAABCACABCBABACA"
  2⤵
  - Executes a command shell one-liner
  PID:8836
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBABBACBCABCAACCBAABABCBABBAAABBABCAABCACABCBABACA"
    3⤵
    - Launches sc.exe
    PID:8312

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCABBCCAAABACAACCCBABCABBBCBAACBCCCCBACCABAAABBACAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCABBCCAAABACAACCCBABCABBBCBAACBCCCCBACCABAAABBACAAAC.exe
1⤵
PID:7968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACACCCCAAABBAACABABCACBBABCBCCBBACCBCBCBBAACAAACBBBCCAABBCCACBCAACAACCACABCABACBCBBBCCBCACABCBABBCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCCCBCBAABBACACABABBBCBBCCBCBCAAAACBCAAAAACBBCCABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:8932
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACACCCCAAABBAACABABCACBBABCBCCBBACCBCBCBBAACAAACBBBCCAABBCCACBCAACAACCACABCABACBCBBBCCBCACABCBABBCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCCCBCBAABBACACABABBBCBBCCBCBCAAAACBCAAAAACBBCCABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBCBACCCCAACBCBCBBCBCBAAABBCAABACBAACCCABBCBBCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCCCBCBAABBACACABABBBCBBCCBCBCAAAACBCAAAAACBBCCABAA.exe" start= auto displayName= "UserDataSvc_ABBCBACCCCAACBCBCBBCBCBAAABBCAABACBAACCCABBCBBCABAC"
  2⤵
  PID:8524
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBCBACCCCAACBCBCBBCBCBAAABBCAABACBAACCCABBCBBCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCCCBCBAABBACACABABBBCBBCCBCBCAAAACBCAAAAACBBCCABAA.exe" start= auto displayName= "UserDataSvc_ABBCBACCCCAACBCBCBBCBCBAAABBCAABACBAACCCABBCBBCABAC"
    3⤵
    PID:8776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBCBACCCCAACBCBCBBCBCBAAABBCAABACBAACCCABBCBBCABAC"
  2⤵
  PID:8420
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBCBACCCCAACBCBCBBCBCBAAABBCAABACBAACCCABBCBBCABAC"
    3⤵
    PID:8324

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCAACACABCACCABBAABCABABCCCABACAAABCCBBCACBBAAACCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCAACACABCACCABBAABCABABCCCABACAAABCCBBCACBBAAACCAAA.exe
1⤵
PID:7904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBCAACACCBCCABCCCCCCBCBBBCBCBACBAABACCBCBBCCBCCACBACBACAACCCBABCAAAABACAACBACBCCCACCABCAABAACAACCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABBCCBCAAAACBCBACCBBAAACABBCABBCAAABCBCACBAACBBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBCAACACCBCCABCCCCCCBCBBBCBCBACBAABACCBCBBCCBCCACBACBACAACCCBABCAAAABACAACBACBCCCACCABCAABAACAACCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABBCCBCAAAACBCBACCBBAAACABBCABBCAAABCBCACBAACBBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABBBCCABBBCCBCBBAAACAABBBAACACAAACCBCBCBBCBBBBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABBCCBCAAAACBCBACCBBAAACABBCABBCAAABCBCACBAACBBAAC.exe" start= auto displayName= "UserDataSvc_BBABBBCCABBBCCBCBBAAACAABBBAACACAAACCBCBCBBCBBBBABB"
  2⤵
  PID:3776
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBABBBCCABBBCCBCBBAAACAABBBAACACAAACCBCBCBBCBBBBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABBCCBCAAAACBCBACCBBAAACABBCABBCAAABCBCACBAACBBAAC.exe" start= auto displayName= "UserDataSvc_BBABBBCCABBBCCBCBBAAACAABBBAACACAAACCBCBCBBCBBBBABB"
    3⤵
    PID:9132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBABBBCCABBBCCBCBBAAACAABBBAACACAAACCBCBCBBCBBBBABB"
  2⤵
  PID:8960
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBABBBCCABBBCCBCBBAAACAABBBAACACAAACCBCBCBBCBBBBABB"
    3⤵
    PID:9132

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCAAABCACCCACAACCBAACCACCCCBBCAAABCCACABACBABCBBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCAAABCACCCACAACCBAACCACCCCBBCAAABCCACABACBABCBBCBB.exe
1⤵
PID:7740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBBAAACBCCBBCAAAAABCCAAAAACBBBACAABBABABABACCCBBAACACACCABBCCBBCCAABCBBBACACCBBCCBCCBAACAABACBABCBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACAABCBABABABCCACBBABBAABBCBCBAABBBBBBBACBCAABBCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBBAAACBCCBBCAAAAABCCAAAAACBBBACAABBABABABACCCBBAACACACCABBCCBBCCAABCBBBACACCBBCCBCCBAACAABACBABCBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACAABCBABABABCCACBBABBAABBCBCBAABBBBBBBACBCAABBCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACAACAACCCBBCBAABBACBCABCBBBBBBBBAAACCCACAACBCACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACAABCBABABABCCACBBABBAABBCBCBAABBBBBBBACBCAABBCCAC.exe" start= auto displayName= "UserDataSvc_CACAACAACCCBBCBAABBACBCABCBBBBBBBBAAACCCACAACBCACCA"
  2⤵
  PID:5280
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACAACAACCCBBCBAABBACBCABCBBBBBBBBAAACCCACAACBCACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACAABCBABABABCCACBBABBAABBCBCBAABBBBBBBACBCAABBCCAC.exe" start= auto displayName= "UserDataSvc_CACAACAACCCBBCBAABBACBCABCBBBBBBBBAAACCCACAACBCACCA"
    3⤵
    - Launches sc.exe
    PID:8324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACAACAACCCBBCBAABBACBCABCBBBBBBBBAAACCCACAACBCACCA"
  2⤵
  - Executes a command shell one-liner
  PID:9068
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACAACAACCCBBCBAABBACBCABCBBBBBBBBAAACCCACAACBCACCA"
    3⤵
    - Launches sc.exe
    PID:9208

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCABBCCAAABACAACCCBABCABBBCBAACBCCCCBACCABAAABBACAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCABBCCAAABACAACCCBABCABBBCBAACBCCCCBACCABAAABBACAAAC.exe
1⤵
PID:7272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBCABCCBABABBACBABCCBABCBAACCAAABBAACABBCBAABAABAACBCBCACCAABBCCCBAABCAAACAABAAACCACCBBBABACBCCCABACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCABCCBABABBACBABCCBABCBAACCAAABBAACABBCBAABAABAACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:9168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBCABCCBABABBACBABCCBABCBAACCAAABBAACABBCBAABAABAACBCBCACCAABBCCCBAABCAAACAABAAACCACCBBBABACBCCCABACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCABCCBABABBACBABCCBABCBAACCAAABBAACABBCBAABAABAACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCBCCBBCBCABABBABBAABAABCCCBCCBCACBCBCBCBCCCCAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCABCCBABABBACBABCCBABCBAACCAAABBAACABBCBAABAABAACBC.exe" start= auto displayName= "UserDataSvc_BBCCBCCBBCBCABABBABBAABAABCCCBCCBCACBCBCBCBCCCCAACA"
  2⤵
  - Executes a command shell one-liner
  PID:8780
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCBCCBBCBCABABBABBAABAABCCCBCCBCACBCBCBCBCCCCAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCABCCBABABBACBABCCBABCBAACCAAABBAACABBCBAABAABAACBC.exe" start= auto displayName= "UserDataSvc_BBCCBCCBBCBCABABBABBAABAABCCCBCCBCACBCBCBCBCCCCAACA"
    3⤵
    - Launches sc.exe
    PID:8540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCBCCBBCBCABABBABBAABAABCCCBCCBCACBCBCBCBCCCCAACA"
  2⤵
  PID:8468
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCBCCBBCBCABABBABBAABAABCCCBCCBCACBCBCBCBCCCCAACA"
    3⤵
    PID:5080

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBAABCCACAACBACCABBBACABACCBBCBBBAAACAACBCBBCACCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBAABCCACAACBACCABBBACABACCBBCBBBAAACAACBCBBCACCCAC.exe
1⤵
PID:1796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACACBBACABBCCABAABBABBACCBBBABABCBBAABABCAABAABBBAACACCBCCCCACCBCABACCAAAAACAABACCABACBBABBBBBABBCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCBBBCAABCBABACAAABBABBABBCCAAACCCAACBBABBACCCBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:1608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACACBBACABBCCABAABBABBACCBBBABABCBBAABABCAABAABBBAACACCBCCCCACCBCABACCAAAAACAABACCABACBBABBBBBABBCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCBBBCAABCBABACAAABBABBABBCCAAACCCAACBBABBACCCBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBACABBBBACBBCACCCBAABACCCCBACABCCACCBBBCCAAABCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCBBBCAABCBABACAAABBABBABBCCAAACCCAACBBABBACCCBBCA.exe" start= auto displayName= "UserDataSvc_ABCBACABBBBACBBCACCCBAABACCCCBACABCCACCBBBCCAAABCAA"
  2⤵
  PID:8656
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBACABBBBACBBCACCCBAABACCCCBACABCCACCBBBCCAAABCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCBBBCAABCBABACAAABBABBABBCCAAACCCAACBBABBACCCBBCA.exe" start= auto displayName= "UserDataSvc_ABCBACABBBBACBBCACCCBAABACCCCBACABCCACCBBBCCAAABCAA"
    3⤵
    PID:5048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBACABBBBACBBCACCCBAABACCCCBACABCCACCBBBCCAAABCAA"
  2⤵
  PID:3192
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBACABBBBACBBCACCCBAABACCCCBACABCCACCBBBCCAAABCAA"
    3⤵
    PID:9544

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBAABCCACAACBACCABBBACABACCBBCBBBAAACAACBCBBCACCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBAABCCACAACBACCABBBACABACCBBCBBBAAACAACBCBBCACCCAC.exe
1⤵
PID:4680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACCCCCCCCCCABBACBCBABABBBCCABBAAACABBABBAACACBCACCBACAABCAACBBBBCBBACBBBBABCAAAACCACBCACCABBCCCACCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAABAACBBAACCCBBACAABBCCBAABBBBABBBAAACCAABCBBCACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:8448
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACCCCCCCCCCABBACBCBABABBBCCABBAAACABBABBAACACBCACCBACAABCAACBBBBCBBACBBBBABCAAAACCACBCACCABBCCCACCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAABAACBBAACCCBBACAABBCCBAABBBBABBBAAACCAABCBBCACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCABCBAAACABCBCACBBBAAACBAACBCBBCCBACCBACBAAACCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAABAACBBAACCCBBACAABBCCBAABBBBABBBAAACCAABCBBCACCC.exe" start= auto displayName= "UserDataSvc_CBCABCBAAACABCBCACBBBAAACBAACBCBBCCBACCBACBAAACCBAB"
  2⤵
  PID:9028
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCABCBAAACABCBCACBBBAAACBAACBCBBCCBACCBACBAAACCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAABAACBBAACCCBBACAABBCCBAABBBBABBBAAACCAABCBBCACCC.exe" start= auto displayName= "UserDataSvc_CBCABCBAAACABCBCACBBBAAACBAACBCBBCCBACCBACBAAACCBAB"
    3⤵
    - Launches sc.exe
    PID:1972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCABCBAAACABCBCACBBBAAACBAACBCBBCCBACCBACBAAACCBAB"
  2⤵
  PID:8952
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCABCBAAACABCBCACBBBAAACBAACBCBBCCBACCBACBAAACCBAB"
    3⤵
    - Launches sc.exe
    PID:9356

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABAAAABCBCACCAABBAACAACCBABCCCCBACAACCABACBAAABAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABAAAABCBCACCAABBAACAACCBABCCCCBACAACCABACBAAABAAA.exe
1⤵
PID:4800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACAABCCAABABABBCBCABBBACAAABCBCBBBBBCBAACAAACCCACCACBAABABAABABCABBAACCAAACBCCACCBACABACAABBBABBCACBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABCCACABCBCBAABCBBACCBACBCBCBCCCBABCBCCBBBBBBAACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:4112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACAABCCAABABABBCBCABBBACAAABCBCBBBBBCBAACAAACCCACCACBAABABAABABCABBAACCAAACBCCACCBACABACAABBBABBCACBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABCCACABCBCBAABCBBACCBACBCBCBCCCBABCBCCBBBBBBAACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCACBABCABCCCCCAAACACCAABBAABCACBACCBAAACCACACABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABCCACABCBCBAABCBBACCBACBCBCBCCCBABCBCCBBBBBBAACBB.exe" start= auto displayName= "UserDataSvc_ABCACBABCABCCCCCAAACACCAABBAABCACBACCBAAACCACACABAB"
  2⤵
  - Executes a command shell one-liner
  PID:6860
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCACBABCABCCCCCAAACACCAABBAABCACBACCBAAACCACACABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABCCACABCBCBAABCBBACCBACBCBCBCCCBABCBCCBBBBBBAACBB.exe" start= auto displayName= "UserDataSvc_ABCACBABCABCCCCCAAACACCAABBAABCACBACCBAAACCACACABAB"
    3⤵
    PID:10444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCACBABCABCCCCCAAACACCAABBAABCACBACCBAAACCACACABAB"
  2⤵
  - Executes a command shell one-liner
  PID:11156

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBCBABABAABAAAABBBACACBBBAABBCCBCBACCBABAAABBCBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBCBABABAABAAAABBBACACBBBAABBCCBCBACCBABAAABBCBBBB.exe
1⤵
PID:8144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACAACBCAAAAACACABCCAAABACCABBAAACCBBCCBCBCCBCCCACABBABACCCACAAABCCCBBCBAACBCAACAAACCBBAACACBBAAABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBAABBBCBABAABAACACBABBACCCBACAABAACAAAACCACABABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACAACBCAAAAACACABCCAAABACCABBAAACCBBCCBCBCCBCCCACABBABACCCACAAABCCCBBCBAACBCAACAAACCBBAACACBBAAABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBAABBBCBABAABAACACBABBACCCBACAABAACAAAACCACABABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10848

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBCBABABAABAAAABBBACACBBBAABBCCBCBACCBABAAABBCBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBCBABABAABAAAABBBACACBBBAABBCCBCBACCBABAAABBCBBBB.exe
1⤵
PID:7712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBABCBCCBCBCCABACCBBABACCABABACBCCABBAABBABBBBCCBBABACBABABAACBCBABBACBABCACCBBCCABABBAACACCCCBCBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABCBCCBCBCCABACCBBABACCABABACBCCABBAABBABBBBCCBBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBBCBAAACCCBCBCCBCAACBCCABACACCAAAACBCCACABABBBABBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBBCBAAACCCBCBCCBCAACBCCABACACCAAAACBCCACABABBBABBBC.exe
1⤵
PID:8432

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAACBCBACAABABACBCCAACACCBAACAACCBABCBABBBBBBABBBBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAACBCBACAABABACBCCAACACCBAACAACCBABCBABBBBBBABBBBBCA.exe
1⤵
PID:624

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCCCBCBAABBACACABABBBCBBCCBCBCAAAACBCAAAAACBBCCABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCCCBCBAABBACACABABBBCBBCCBCBCAAAACBCAAAAACBBCCABAA.exe
1⤵
PID:3412

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACAABCBABABABCCACBBABBAABBCBCBAABBBBBBBACBCAABBCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACAABCBABABABCCACBBABBAABBCBCBAABBBBBBBACBCAABBCCAC.exe
1⤵
PID:8272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBCCBACCAAACCABCBBCBCBBBBCCCBABABABCBCACCACCBBBCABBABCBBCBCBCCCBBCCBCACBBBCACABCAAACCBAABBBABBBAACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCCBACCAAACCABCBBCBCBBBBCCCBABABABCBCACCACCBBBCABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:2204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBCCBACCAAACCABCBBCBCBBBBCCCBABABABCBCACCACCBBBCABBABCBBCBCBCCCBBCCBCACBBBCACABCAAACCBAABBBABBBAACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCCBACCAAACCABCBBCBCBBBBCCCBABABABCBCACCACCBBBCABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCCBBBBCACABBBCCABCBAAACABBBACBACABCAACBCAAAABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCCBACCAAACCABCBBCBCBBBBCCCBABABABCBCACCACCBBBCABBA.exe" start= auto displayName= "UserDataSvc_AACCCBBBBCACABBBCCABCBAAACABBBACBACABCAACBCAAAABABB"
  2⤵
  PID:820
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACCCBBBBCACABBBCCABCBAAACABBBACBACABCAACBCAAAABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCCBACCAAACCABCBBCBCBBBBCCCBABABABCBCACCACCBBBCABBA.exe" start= auto displayName= "UserDataSvc_AACCCBBBBCACABBBCCABCBAAACABBBACBACABCAACBCAAAABABB"
    3⤵
    - Launches sc.exe
    PID:10000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCCBBBBCACABBBCCABCBAAACABBBACBACABCAACBCAAAABABB"
  2⤵
  - Executes a command shell one-liner
  PID:10292
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACCCBBBBCACABBBCCABCBAAACABBBACBACABCAACBCAAAABABB"
    3⤵
    PID:10608

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABBCCBCAAAACBCBACCBBAAACABBCABBCAAABCBCACBAACBBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABBCCBCAAAACBCBACCBBAAACABBCABBCAAABCBCACBAACBBAAC.exe
1⤵
PID:7172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCCBAACABCBABABCCAABCCCACCCBCABABAACBBAACCBBCCAACCBACCAACACCCBCBABACABACCABAAACBCAABAAABCAAABACCCACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAACCCACCABAABBACACCBAABCAABBBBBACABACACBCAAACBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:10464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCCBAACABCBABABCCAABCCCACCCBCABABAACBBAACCBBCCAACCBACCAACACCCBCBABACABACCABAAACBCAABAAABCAAABACCCACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAACCCACCABAABBACACCBAABCAABBBBBACABACACBCAAACBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    PID:11100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCCCABACBCCCABCBACCCBCCABCABABAAABCBCCCBCBABBBABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAACCCACCABAABBACACCBAABCAABBBBBACABACACBCAAACBBBBA.exe" start= auto displayName= "UserDataSvc_ABCCCABACBCCCABCBACCCBCCABCABABAAABCBCCCBCBABBBABCA"
  2⤵
  PID:10688

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABBCCBCAAAACBCBACCBBAAACABBCABBCAAABCBCACBAACBBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABBCCBCAAAACBCBACCBBAAACABBCABBCAAABCBCACBAACBBAAC.exe
1⤵
PID:3388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCBABBBAABBACBBBAACBABAACBABABABCBAAAACCBBBCBCCCABCCBCABABAACABCBABBBAAAABBBBBCABBCABBACBAAAAABAAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABCACACACBAACBABCACBCBBCCBABABBCAACCBBCACBBBABCCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBCBABBBAABBACBBBAACBABAACBABABABCBAAAACCBBBCBCCCABCCBCABABAACABCBABBBAAAABBBBBCABBCABBACBAAAAABAAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABCACACACBAACBABCACBCBBCCBABABBCAACCBBCACBBBABCCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10516

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCABCCBABABBACBABCCBABCBAACCAAABBAACABBCBAABAABAACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCABCCBABABBACBABCCBABCBAACCAAABBAACABBCBAABAABAACBC.exe
1⤵
PID:5172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACBCAAABCCCCACCBABBBBBBAAACBBBBAABCABAAACBCCCBBCABABBBACBCBCCBCCBCCAACCACABBACAABABAACBBCBCABCBCCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBACBBCAABAACACCBBABCAACCCCBBCABBBBBCBABCBBAACBBCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:10868
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACBCAAABCCCCACCBABBBBBBAAACBBBBAABCABAAACBCCCBBCABABBBACBCBCCBCCBCCAACCACABBACAABABAACBBCBCABCBCCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBACBBCAABAACACCBBABCAACCCCBBCABBBBBCBABCBBAACBBCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3320

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAABAACBBAACCCBBACAABBCCBAABBBBABBBAAACCAABCBBCACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAABAACBBAACCCBBACAABBCCBAABBBBABBBAAACCAABCBBCACCC.exe
1⤵
PID:8520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABBCABACACBCCACBAACCBCCABBCCBABCACBACAAACACBCABCAABBCBCCCAACABBAAAAACCBBBBBBBACBACABBACBCCBBCABAACABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBCACABBBCCACCBAACACBBCCABAACAAABCACAABAABCABCAACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11132

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCCCBCBAABBACACABABBBCBBCCBCBCAAAACBCAAAAACBBCCABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCCCBCBAABBACACABABBBCBBCCBCBCAAAACBCAAAAACBBCCABAA.exe
1⤵
PID:8204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACBCAAAABCCBBCAABBACBBBCACABCAABAABACABABCCCCAACBAACACCABAABBCCCCBBBBBCCBBCCBACAAABBBAAAABACCCBBBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCACAAAABABBBCCBAAACBCCCBBBCACABCCBACAAAAABBBBAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:6756

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCABCBBABBACBBAAABCBBBBCABCAAABBABBCAABABBAACCACCABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCABCBBABBACBBAAABCBBBBCABCAAABBABBCAABABBAACCACCABBA.exe
1⤵
PID:9076

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACAABCBABABABCCACBBABBAABBCBCBAABBBBBBBACBCAABBCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACAABCBABABABCCACBBABBAABBCBCBAABBBBBBBACBCAABBCCAC.exe
1⤵
PID:9032

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCBBBCAABCBABACAAABBABBABBCCAAACCCAACBBABBACCCBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCBBBCAABCBABACAAABBABBABBCCAAACCCAACBBABBACCCBBCA.exe
1⤵
PID:248

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCABCCBABABBACBABCCBABCBAACCAAABBAACABBCBAABAABAACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCABCCBABABBACBABCCBABCBAACCAAABBAACABBCBAABAABAACBC.exe
1⤵
PID:456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBCBABBCCCCBBCCACABBABABCABAAAABCCCBCCCAACBCCCBCBCCAABBAACACBBABBCBCBBBBCACCBACAAAABACCCACBCBCABABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBABBBABCABBCBCABAABBBBCABBBBBBBCCAAAABBABCBCACACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:9880
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBCBABBCCCCBBCCACABBABABCABAAAABCCCBCCCAACBCCCBCBCCAABBAACACBBABBCBCBBBBCACCBACAAAABACCCACBCBCABABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBABBBABCABBCBCABAABBBBCABBBBBBBCCAAAABBABCBCACACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBAABACACCCCCBCCCBABCACBAACBBCACBCCCAACACACBABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBABBBABCABBCBCABAABBBBCABBBBBBBCCAAAABBABCBCACACCA.exe" start= auto displayName= "UserDataSvc_BCBBAABACACCCCCBCCCBABCACBAACBBCACBCCCAACACACBABABB"
  2⤵
  PID:9976
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBAABACACCCCCBCCCBABCACBAACBBCACBCCCAACACACBABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBABBBABCABBCBCABAABBBBCABBBBBBBCCAAAABBABCBCACACCA.exe" start= auto displayName= "UserDataSvc_BCBBAABACACCCCCBCCCBABCACBAACBBCACBCCCAACACACBABABB"
    3⤵
    - Launches sc.exe
    PID:4688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBAABACACCCCCBCCCBABCACBAACBBCACBCCCAACACACBABABB"
  2⤵
  PID:4260
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBAABACACCCCCBCCCBABCACBAACBBCACBCCCAACACACBABABB"
    3⤵
    PID:9352

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAABAACBBAACCCBBACAABBCCBAABBBBABBBAAACCAABCBBCACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAABAACBBAACCCBBACAABBCCBAABBBBABBBAAACCAABCBBCACCC.exe
1⤵
PID:9420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACBCACABBBCCACCBAACACBBCCABAACAAABCACAABAABCABCAACABAAACCBCABCCBBACBABBCCABBAAACCBBCBAACCAACABBCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABAACACBCAAABBBBCCBACAACBABCACABCCBACCCCBBBACCBACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCBBBCAABCBABACAAABBABBABBCCAAACCCAACBBABBACCCBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCBBBCAABCBABACAAABBABBABBCCAAACCCAACBBABBACCCBBCA.exe
1⤵
PID:9648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBACCACCBAAACCAACBCBCAACCBCBCBCBABBBAAACBABCBCCABCCACBACACCBCBCBBCCAAABACABBAAACABBACBAACAABABABBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBCAAAABCCBBCAABBACBBBCACABCAABAABACABABCCCCAACBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:11204

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCABCBBABBACBBAAABCBBBBCABCAAABBABBCAABABBAACCACCABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCABCBBABBACBBAAABCBBBBCABCAAABBABBCAABABBAACCACCABBA.exe
1⤵
PID:9684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACBCAAAABCCBBCAABBACBBBCACABCAABAABACABABCCCCAACBAACACCABAABBCCCCBBBBBCCBBCCBACAAABBBAAAABACCCBBBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBCAAAABCCBBCAABBACBBBCACABCAABAABACABABCCCCAACBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  PID:11072

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABCBAAABAACACCBBCCBAACACBAACCAACACBABCAAACCBCCBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABCBAAABAACACCBBCCBAACACBAACCAACACBABCAAACCBCCBCAB.exe
1⤵
PID:9768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCCBABAACABABBBACAACCAAABCBBBCCAACBAAAAACBAABCABAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCCBABAACABABBBACAACCAAABCBBBCCAACBAAAAACBAABCABAAA.exe
1⤵
PID:9872

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABCBAAABAACACCBBCCBAACACBAACCAACACBABCAAACCBCCBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABCBAAABAACACCBBCCBAACACBAACCAACACBABCAAACCBCCBCAB.exe
1⤵
PID:10036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBCBCCBCABCCBCCABABCCBCBBBACBACCCCBBBACBCBBBACCCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBCBCCBCABCCBCCABABCCBCBBBACBACCCCBBBACBCBBBACCCAAA.exe
1⤵
PID:2552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCABBCBACCCBCBAABBCBBCCCBBABBBBCBBBAAAABACBCABBACCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCABBCBACCCBCBAABBCBBCCCBBABBBBCBBBAAAABACBCABBACCCAC.exe
1⤵
PID:2640

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBCBCCBCABCCBCCABABCCBCBBBACBACCCCBBBACBCBBBACCCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBCBCCBCABCCBCCABABCCBCBBBACBACCCCBBBACBCBBBACCCAAA.exe
1⤵
PID:2428

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCABBCBACCCBCBAABBCBBCCCBBABBBBCBBBAAAABACBCABBACCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCABBCBACCCBCBAABBCBBCCCBBABBBBCBBBAAAABACBCABBACCCAC.exe
1⤵
PID:9468

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCCBABAACABABBBACAACCAAABCBBBCCAACBAAAAACBAABCABAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCCBABAACABABBBACAACCAAABCBBBCCAACBAAAAACBAABCABAAA.exe
1⤵
PID:9512

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCCACCBCCCCAACABCCCBCACBCBACBBBCABCBABAABACCACAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCCACCBCCCCAACABCCCBCACBCBACBBBCABCBABAABACCACAAAB.exe
1⤵
PID:9564

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCCACCBCCCCAACABCCCBCACBCBACBBBCABCBABAABACCACAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCCACCBCCCCAACABCCCBCACBCBACBBBCABCBABAABACCACAAAB.exe
1⤵
PID:6508

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBBABBBBCABACACBBABACABACCCAAAABBBABCABCCCAACCBACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBBABBBBCABACACBBABACABACCCAAAABBBABCABCCCAACCBACAB.exe
1⤵
PID:9460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBABBBABCABBCBCABAABBBBCABBBBBBBCCAAAABBABCBCACACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBABBBABCABBCBCABAABBBBCABBBBBBBCCAAAABBABCBCACACCA.exe
1⤵
PID:9484

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBACABAABBAACCBAABAACABABCBAABCBBCCACABBBAAAAABCBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBACABAABBAACCBAABAACABABCBAABCBBCCACABBBAAAAABCBBCC.exe
1⤵
PID:5784

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBACABAABBAACCBAABAACABABCBAABCBBCCACABBBAAAAABCBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBACABAABBAACCBAABAACABABCBAABCBBCCACABBBAAAAABCBBCC.exe
1⤵
PID:1624

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCBCCCABCBACABACACBABBBBACBBBAAABBABBACCBAAAAACAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCBCCCABCBACABACACBABBBBACBBBAAABBABBACCBAAAAACAACA.exe
1⤵
PID:1864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCBCCCABCBACABACACBABBBBACBBBAAABBABBACCBAAAAACAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCBCCCABCBACABACACBABBBBACBBBAAABBABBACCBAAAAACAACA.exe
1⤵
PID:6600

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCCBACCAAACCABCBBCBCBBBBCCCBABABABCBCACCACCBBBCABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCCBACCAAACCABCBBCBCBBBBCCCBABABABCBCACCACCBBBCABBA.exe
1⤵
PID:5740

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCCBACCAAACCABCBBCBCBBBBCCCBABABABCBCACCACCBBBCABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCCBACCAAACCABCBBCBCBBBBCCCBABABABCBCACCACCBBBCABBA.exe
1⤵
PID:10644

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABCCACABCBCBAABCBBACCBACBCBCBCCCBABCBCCBBBBBBAACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABCCACABCBCBAABCBBACCBACBCBCBCCCBABCBCCBBBBBBAACBB.exe
1⤵
PID:2892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABABBCBBCACABCAABAABCBBABACABCBAACACABACBBBCBCBCACCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABABBCBBCACABCAABAABCBBABACABCBAACACABACBBBCBCBCACCCC.exe
1⤵
PID:3504

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACBBCBCBCBBCBABCBBAABABCBCCCABCCCCCBCBABACABABCAACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACBBCBCBCBBCBABCBBAABABCBCCCABCCCCCBCBABACABABCAACBC.exe
1⤵
PID:10680

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABABBCBBCACABCAABAABCBBABACABCBAACACABACBBBCBCBCACCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABABBCBBCACABCAABAABCBBABACABCBAACACABACBBBCBCBCACCCC.exe
1⤵
PID:10804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3f7b21fdeb676550af4cdd906637b2b122fcc7538c706d22a5d8dbd5f27aa287
MD5 831f4f23c178ffe8b3169d45ec1fe824
SHA1 62317f69d8422ca26bfc1e700a51dfebd41faf50
SHA512 ca683b5099ae1d947d52ebca4c2d9f1a67703757c9aa0b1ea5680578c051291e38c9ff60ae8468fafd00c27fddfbf17f68caf36599455cd083ed6debd25ae1e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5410c54ccab0ea60acdc0e536eb1bc6a69a2aef52983001564eb99d8e9e41581
MD5 16c85703563fc408f867b9a62ba58627
SHA1 1b1f5a84a0a13a108a54b1aed651d4b5ca3c64b6
SHA512 c93bdbae1144a4861cae00cf4d75072f549909b3dc8ec7ef917778ae251ffe6b13f8ee69e1cced70147f4b4dbe4fbd9121c2316057f6a0ed3401a264aea55377
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5783a18d3d2f08e1bdeae6e628327e80dbcb8630ad41056aca22a96c61bdfe39
MD5 0f4132445ea81dc374c6cbb371661d26
SHA1 60e2a537350e0f8309899f97cab2e5405d982e2e
SHA512 46b24bb4cbcd8ca1616d335641afa3236c3a8aeeed6bfc82531fa35ecce9db8e9390eacc593751ca4f3db9c9dcbfd958ea157fb463e125c716839522022ec2e1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9683e62618a94c569ab0219f7bd5a49ecbf2c7637dd5588938b8192036873ed6
MD5 5b00044000d441248e7c6e4c70faebc8
SHA1 5d585e0c4997f2fec4da133a9b331afe94465d8b
SHA512 9eecdcd6d1624f8c55090b6917f34989800832753c4e9aea2b2196cd1aa835bb667e4a23f6bb164299d75b5c0d90d7cfca2c3fa880697d08b940041529026ac8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4c9fef51c9eb9972e4c9188077956aca7e496211fb2cc269f1f71f1fedbbb063
MD5 e650decadbc8c8a230fecde660e2c154
SHA1 aa7b03cdc4fac41734177248b77d4a5dfecd342b
SHA512 2d9ed1c47306c81dc6b7f0dc2d20af078a510c2e6b38a2dcbba31afc8232347625a875add80b80e6d5465a96f5614c7686aa07d229411a800e66724a837cdf6a
MD5 SHA1 SHA512

Submit Download

svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACAABACBBBCACACCBACABACBBBBAABBAACCCABBBCCBCBBACBCCCC.exe
Size 7.5MB
SHA256 abce3098723f7ea784e071b47597c2ecd1356ec7a570a7b1756c061ab8a39be0
MD5 b71e3b9e2168fefa5d4d35ea63be5e9b
SHA1 22e3b974a904886ab0fc08246267db16dd5c330f
SHA512 9a8a57fe1b4b48df464f2a6c64e0849e3d8a74b3e8f34bb30348ca8008a3b1fcb6aa3212f938199eb1d35d6e16bd2c67eacc3df0935dde07acdfc18a49c747cd
SSDEEP 49152:PbE2kZAW2ROQcverO04TcbE2kZAW2ROQcverO04TcbE2kZAW2ROQcverO04TcbEm:b4Tk4Tk4Tk4Tk4Tk4Tk4Ti
TLSH
T11F862A1263EC115CF1F71B72EE39A552A97AFCEE7E12E51E0455340E20B2B14CA6A337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 5KB
SHA256 8ec7cecacc0dc7bca93f1ddc51a33155314d59c6f646f2c7aac39d75be1bbbca
MD5 ba9b1656310cf02627c70d46d8f4166a
SHA1 edc8b7543033d6aea9f6ae9d2b3fc6fb0bd5873b
SHA512 84a2624df18c2ebf04282ff9bec91e3efd72bf7d30443b9669ad82c9d4e8d79b58bcd47315abec4863cd258455746b28208f63baa0fb651bffedbe8d14346e70
SSDEEP 96:ojXwGXws1wz40Q1qt4ERbE+5+rVyId12+xF4+xcJfIP12A64ApJfWLuK/l+x2:RzstLmKEChP7F/s2
TLSH
T1A9B11BA1A0B6DC63B121A4CBDB39D9C54AD477AF5CCC5A75B3098219B784933CCEB0D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 acb4631972aee6b18b4701a8073ff75e3e363886be7b3a747b2134740afe91d3
MD5 e2cd4b8c8ab88f33ba4212a1924a7dd5
SHA1 4c793055d6d10f69e826ba0ad45f7e9edf9cdae8
SHA512 ff8532d0ac08c191c2cddcb9c216d7c8c29e03369e022e3165bc9dfbe52b7ec652d9d2f74a277638c8f3c1acc2209fc7fe0a9758f6c50949ae842ef4bda78188
SSDEEP 96:ojXwGXws1wz40Q1qt4ERbE+5+rVyId12+xF4+xcJfIP12A64ApJfWLuK/l+xl1uZ:RzstLmKEChP7F/slZi
TLSH
T1BED107A1A0B6DC63B13164CBDB39DAC649E473AF5CCC5A65B3098219B794C338CEB4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 a90686088feea58292f4520794a9751bd5b6e6d8962e0ef79a54fa71d53c688b
MD5 518bd9a938d576fd448b8faa3a706a31
SHA1 9d288824171710281b7e0766a3e447856564339f
SHA512 c7af5c615364f21b0d2eb71c933ec68f70228bf7de2d0641f206ac06478d1b901f0ec2100c444503b4e3e8403d7cb6bc9587bde571abf37ab94bf0527fe7a801
SSDEEP 96:ojXwGXws1wz40Q1qt4ERbE+5+rVyId12+xF4+xcJfIP12A64ApJfWLuK/l+xl1uT:RzstLmKEChP7F/slZW1
TLSH
T13CE1F6A1A0B6DC63B121A4CBDB39DAC549E473AF5CCC5A65B3098319B794C338CEB4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 34fdbecab3c6b614c21561b93dcfd49fca719f190a72cc681790e5fe2facc6c2
MD5 931f50bb63258ed3231f647d5c8a3b7b
SHA1 ca857bdbe65af15246132111d9e4dd16381551aa
SHA512 70729abd0f6fd49bcbb9c8b164fcad7e914f7ac4ff65216d7206fc8ab54a25e81976fe3f9bf705059f7e14aa57763567408b29b88f3056d1e4817b33f44d4a7d
SSDEEP 96:ojXwGXws1wz40Q1qt4ERbE+5+rVyId12+xF4+xcJfIP12A64ApJfWLuK/l+xl1ub:RzstLmKEChP7F/slZW1/
TLSH
T19DE1E5A1E0B6DC63B121A4CBDB39DAC549E473AF5CCC5A65B3098219B794C338CEB4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 6KB
SHA256 987e064007299108536eeb5c254c6608a083176f3fe39a9bf5bef63ae31b581b
MD5 3ffcc4bfec25ca5a84408b572dda10bf
SHA1 1c48a77fcb3e7c453f5ea03e595113a80be483d8
SHA512 032bfdf822a38b91e9b52c57784e03c35168c3fa8e857582e6ac9ba419a9a4eaf1ac2aa2fbbacafe3ea7fab5fc8705191bec8ad4f0374ad9c94ddb8b7ba59348
SSDEEP 96:ojXwGXws1wz40Q1qt4ERbE+5+rVyId12+xF4+xcJfIP12A64ApJfWLuK/l+xl1uY:RzstLmKEChP7F/slZW1I5
TLSH
T12DE1E4A1E0B6DC63B121A4CBDB39DAC549E473AF5CCC5A65B3098219B794C338CEB4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 7KB
SHA256 7e57e40f9d949e5cf96d02ce8eee804978b1ced66b8cafa4e5b05b9c25e91c9f
MD5 ef13dd37cf16520fe2816ac23a7403bb
SHA1 9b13697a5a7bd2ad586ae31334d4705258ef369b
SHA512 6e32a8690fb15d4cc8fd9577264e36708500a025b609c0bc488ed69330924cb58def2a8e0220065f4db7c55ab1055634fe74eca87be407484ed3fcbc82162680
SSDEEP 96:ojXwGXws1wz40Q1qt4ERbE+5+rVyId12+xF4+xcJfIP12A64ApJfWLuK/l+xl1uY:RzstLmKEChP7F/slZW1Ip3
TLSH
T1CFE1F5A1E0B6DC63B121A5CBDB39DAC149E473AF5CCC5A65B3098319B7948338CEB4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 7KB
SHA256 81b96b3516024ee7aebaa341748cfdd3cf2094a9485043759237c644f651af92
MD5 697213b20a9157c6b1a620b4056b635d
SHA1 9cf0a4444a826ad244f60c8b47a77700ff615227
SHA512 57b99dc2ca3a4f84715d138b6628726de583ecf0eaf8e434b5b4fac870f62cfbe24f603c8dd9563be7dbd5745baf1d78e6118f8919bfd641edc04f4237b66e7a
SSDEEP 96:ojXwGXws1wz40Q1qt4ERbE+5+rVyId12+xF4+xcJfIP12A64ApJfWLuK/l+xl1uS:RzstLmKEChP7F/slZW1Ips8
TLSH
T109E1F5A1E0B6DC63B121A5CBDB39DAC149E473AF5CCC5A65B3098318A794C338CEB4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 8KB
SHA256 c22ee861a71dc43432cf5b5a70f78b2dea656237cedb5a3de21ffe1f16ccc417
MD5 fa316792ed33acf53934ea64d5a45cb8
SHA1 bf50c5a789b8983575b8821e03dda24901851ac2
SHA512 fbf5a62463243d5e934f332306a2d479e68250a2f73726400491bb5e8f829313a74dbb6dbb2f214a428bd61b036129ae95e9e91f45bfcec0c42f576bcd4a7d86
SSDEEP 96:ojXwGXws1wz40Q1qt4ERbE+5+rVyId12+xF4+xcJfIP12A64ApJfWLuK/l+xl1uF:RzstLmKEChP7F/slZW1Ips6gVDTQC
TLSH
T12C02E4A1E0B6DC63B13165CBDB39DAC649E473AF5CCC5A65B3094218AB94C338CEB4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 9KB
SHA256 03655c9f039cc5439dbca242c240dd9f50d1deebe5b1b5c10e28773938c8df42
MD5 0deba466a2373db854e8a95c4691bcd0
SHA1 00ed27cf8a3f8ced262d1b5693600349a782fdd6
SHA512 69ad533af879833d72527e758f8d8680eb883b641981470af662490400ec8172d8f7b2f1994525b584246ec47f58453d0e35287900752cdde23a89b56988acf9
SSDEEP 96:ojXwGXws1wz40Q1qt4ERbE+5+rVyId12+xF4+xcJfIP12A64ApJfWLuK/l+xl1uy:RzstLmKEChP7F/slZW1Ips6gVDTQnKQ
TLSH
T10112E4A2E0B6DC63F13169CB9739DAC249E473AF5CCC5A64B3095618A794C338CEB4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 9KB
SHA256 bfc5e446707fd05921c04110963532b2c970f08f68194acaa25a098e7f7b33c7
MD5 542d6f4bda665839fee772d468d8a9d7
SHA1 0b50176b414181ff6c23da5532f4961d4c6360e8
SHA512 9f2ff63153337630d1e22dde6fe1b224efc28735c8c6c5ddd08592f77347cf6611f307636f03f422a21e868834a865e4a618a9e78678dd373cc8a954dc2c800d
SSDEEP 96:ojXwGXws1wz40Q1qt4ERbE+5+rVyId12+xF4+xcJfIP12A64ApJfWLuK/l+xl1uz:RzstLmKEChP7F/slZW1Ips6gVDTQnKh
TLSH
T12922D5A2E0B6DC63F13165CB9739DAC249D473AF5CCC5A64B3095618A794C338CEB4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 433B
SHA256 4fb3578202c7b5df5dde8d0f8c693d6b5a4a4a34e193e707044c18a08e6c2c4d
MD5 9da17620273209736c90b92084ffdfa7
SHA1 783f23fa1886de59030021fdd26202093d2e0b6c
SHA512 9580d3387792a0afe812263adfea49d650d6ea61c5e74b93c4ef1b4fa60cc93057568d9c0e874ed3a2c27e8f880f23c59b3a3ed302169e80b78a8654c4bef3e7
TLSH
T11FE0E5E1A0F5CC83B021A4D7EF39DAC245E4770D94EC19B473041214A755C338EDE8B1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 10KB
SHA256 3628444b8deab1a98a7b9377e8de0f4f3acfce50ab35dcca1c0c534a2f550915
MD5 671b3c2cd1ff0226e87aa01a71f14ebd
SHA1 d01ed0cb19fdeb8c416c44c800e49a5678423a6c
SHA512 2109090394d8a253456e519b8541ca080d8d9d3ed2d2f10ff357051cad9ee2c4c7b2f189528cc9a6d164aeccb0ed47752a969b1a10429edb381d89dd530efee9
SSDEEP 96:ojXwGXws1wz40Q1qt4ERbE+5+rVyId12+xF4+xcJfIP12A64ApJfWLuK/l+xl1uY:RzstLmKEChP7F/slZW1Ips6gVDTQnKBo
TLSH
T1F422C5A1E0B6DC63F13165CB9739DAC249D473AF5CCC5A64B3099618A794C338CEB4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 10KB
SHA256 9f790521b08f8034a6bd4ba12bcfad15cc93b95b0ffcb38dee9f6d0319d1474a
MD5 a7ebb0d6bfc1f06bc27645637b9d7b9f
SHA1 ad87ea5b4aec66998a29959e4b79c4bfbf922215
SHA512 a0b9191aef062ba79f4fa38b782964d68180f70c1f66c3856e7dc7f91a4c713fae923538c82cb1a8db21fb679970bf193dd79601eb0143fd84e5cee65b3b4651
SSDEEP 192:RzstLmKEChP7F/slZW1Ips6gVDTQnKB8U:SmKEiPx/sq1IpwVDTQg8U
TLSH
T1BA22C4A1E0B6DC63F13169CB9739DAC149D473AF5CCC5A64B3099618A794C338CEB4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 10KB
SHA256 bab984dd0d42fe89b625e9e187697e4d30d4f9c0b17dfa46c63f9ca6cc705836
MD5 6e286b5d3e60780053d6132771c18f30
SHA1 687364205f267debd92ab21b211100853b91e900
SHA512 79e348fcadebdd44cc5d5fb87f77c9be48aac71880173ae634a6123f091a3d82a0e4cd7500d0cc9690d2a1e45cdfab43d30eb68f6a47533c8c4258e8257cb0a3
SSDEEP 192:RzstLmKEChP7F/slZW1Ips6gVDTQnKB8EG:SmKEiPx/sq1IpwVDTQg8EG
TLSH
T1CD22C4A1E0B6DC63F13169CB9739DAC149D473AF5CCC5A64B3099718A7948338CEB4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 10KB
SHA256 86d25138553b2a9ce1ce175fac44a05ae3daed9332e34174d41392ccc08fad3b
MD5 250ea7e84283eeb9b4bd4448c9c94e2f
SHA1 cf55ce96c3c8efd1725f5d6a09332d2a4a33234d
SHA512 a47c1def7fc373d49b4eb4ccddb9c42df1d88daee8f250cc224e0d2e848aa251b99108de1bee5c0e320e2db3ae881c31871ff2e2f0805015604934be25f23c0e
SSDEEP 192:RzstLmKEChP7F/slZW1Ips6gVDTQnKB8Ei8:SmKEiPx/sq1IpwVDTQg8Ei8
TLSH
T18A22C4A2E0B6DC63F13169CB9739DAC149D473AF5CCC5A64B3099718A7948338CEB4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 10KB
SHA256 e5f63e4b53252ccf1c88fd11513b9930bc3af99c21b7e1e688eff52421a2a6f9
MD5 0c041718f2583ad2c3986b8379fbb933
SHA1 8410c3ee5e86b4a36e6f6412fb724d27be766259
SHA512 e2e8f5d7bcebf953b800c38537e6277b7c7d81c66479d5b8b3dffae21f0a8610133ba022ed3291837bc9fa9130ad478753089947975b62cff143a69dd4fe03a4
SSDEEP 192:RzstLmKEChP7F/slZW1Ips6gVDTQnKB8EiGr:SmKEiPx/sq1IpwVDTQg8EiGr
TLSH
T12A32B4A2E0B6DC63F13169CB9739DAC149D473AF5CCC5A64B3099618A794C338CEB4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 899B
SHA256 f5a3012a3aaad9ab1b823be6a557b71bd78ea0f990e3971990e699016287d14d
MD5 6dff98725dd46f6ca6060b08396d2058
SHA1 549f732329b5aa8169c015250629c96d9589dbfa
SHA512 bea35a515414d70a8d19f4a86e17de52955a6e9dee7f9d3aa0349b597d180da3231205e3be7af13cd8c71f4a2a64a887760df2dbf821c617cebf73f2463d7d42
TLSH
T1E611C1E1A0F6CC93A021A4D7DB39D9C249D4779E64DC6A7473098218A7558338DDA4E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 11KB
SHA256 429df488e46ef01458b1d25dcce02053ae8402d3f48c1f31a9efba46cecfea02
MD5 f0b85512a6facdcea216bd827eb59f69
SHA1 de60739ab23a6d82804ccd258865de4587d463b0
SHA512 266fe544cc46ef8bc47bd9a8bf8b58c19ed00540e057aa6a81e2e4d9fe8af6351b726e5e68de3bbd7ab494a0960e93edd55e7b8f6f0b042c9e92386877484df4
SSDEEP 192:RzstLmKEChP7F/slZW1Ips6gVDTQnKB8EiGQSr:SmKEiPx/sq1IpwVDTQg8EiGhr
TLSH
T17132C3A2E0B6DC63F13169CB9739DAC249D4739F58CC5A64B3099718A794C338CAB4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 905c4b37384b443f456c5d7a6fbd597972ec73e709f91e124ebc8ebd16fb836c
MD5 7cf9f48e03e8d49908f46ba844fbf6a1
SHA1 2c672adf55e5a5582cd45f417cd42ac1f8c7f14d
SHA512 a5ae8f84a1d6efbfa78b7bedfaca452ca78bc2174eedb69ab8919343eff39626890e85ff1a60b0e925880caa6639104c28a6840ca894f3e036318b3c09bb9871
SSDEEP 192:RzstLmKEChP7F/slZW1Ips6gVDTQnKB8EiGQSQ+z6kFz6kFG:SmKEiPx/sq1IpwVDTQg8EiGhJ6kJ6kFG
TLSH
T15D42E4A1E0B6DC63F13169CB9739DAC249E4739F5CCC5A64B3099718A794C338CAB4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 35d08be56d47a3ff81db74e6093f3fdd484a5c034c0a0a49e63e04f72d8cc8e6
MD5 9116ef638c70c4647a3421fbc0e9e68e
SHA1 24f0f32e63ae93d69753cffc2b900838832793d8
SHA512 96ba7425a0998dccf393b1c523ef278557ac16d493fd47942d75e66aad8a93b7a2b236ff3695f904f0301e8c54e86df06ee9978b7cdc572fd983bd2aeacabb9f
SSDEEP 384:SmKEiPx/sq1IpwVDTQg8EiGhJ6kJ6kFRihn:SmEPx0q1VVDTb8MhJ6kJ6kFRih
TLSH
T16642E4A1E0B6DC63F13169CB9739DAC149D4739F5CCC5A64B3099718A794C338CAB4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 5a4f485b04f7f5a25be85a69f0db4cac9bdafcf9b5782c72f5328b2b48e86242
MD5 962cf86aa7982867e51cea7e5027727c
SHA1 86f55f99f4d79dfe618d07ee0c4d0cfe32077ac3
SHA512 6b66ed1e79556e2eaf6e9abe3c175ae794192e4745eb626139eb263cbc8e51caa948ba781731ec4b5eb05ed1b9a47f566bcbfae837ddc6497703d25c312bcf15
TLSH
T1F72125E1A0F6DC93F031A4C7DB39C9C249D4738E24DC6A74730D8218A7948338DDA4E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 6c0ce36a4a287dafac91faf93887e8c238ed18065f5f54bc612c330636d02354
MD5 78ba81eb634a4832efb9963b48a5d062
SHA1 112758cfd02f086f205d38b72a404c76cfdaa6ba
SHA512 5080c6a92515497efc98d5e1018dd188e3b98ab0f53e96ceb7db9d289d8ddcb8ab9f6aaa0d34b63b14cffdc85b3fa09c979ed9c7bcee94256d4319c1ea444107
SSDEEP 384:SmKEiPx/sq1IpwVDTQg8EiGhJ6kJ6kFRihdI:SmEPx0q1VVDTb8MhJ6kJ6kFRic
TLSH
T1D242E4A1E0B6DC63F13169CB9B39DAC149E4739F5CCC5A64B3099718A794C338CAB4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 12KB
SHA256 7408566059cec5d3b52f6151027e3ed2ea7eec086ef8f7fd5fb566d058f4527c
MD5 77b824bbf1e7989b2d0786b8d358a80c
SHA1 3bbd5aa905d2f0fe0ad5eb1fb12e1d2c22f68264
SHA512 f071e3186710629373f6e0da62731dc3a4475eb7b7aa8810ebd3d0887703fa114c2cedf8d2c767710fc25d665d40e836637be02896e6f03701725516513fa39b
SSDEEP 384:SmKEiPx/sq1IpwVDTQg8EiGhJ6kJ6kFRihdkf:SmEPx0q1VVDTb8MhJ6kJ6kFRi2
TLSH
T13542E3A1E0B6DC63F13169CB9739DAC149E4739F9CCC5A64B3099718A794C338CAB4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 13KB
SHA256 2e9117dafb4983698e702328a2f5214c059caf9ace15a8afaa6d0017d9e68c3c
MD5 57d8200fcab0d4c2449a4cb8cf5246cf
SHA1 ec67893122ff2929ba0e41593cc55ca13b1c33bd
SHA512 48dc5dcfcab3f098ce26cda56fab8e2d47e0e2b9756c349d8494c93d5ac710c3166fd0a6d182d500cfd035affce56932a7b318f09c70f51cd9359e0ae0dc7c79
SSDEEP 384:SmKEiPx/sq1IpwVDTQg8EiGhJ6kJ6kFRihdkP:SmEPx0q1VVDTb8MhJ6kJ6kFRiQ
TLSH
T14552D3A1E0B6DC63F13169CB9739DAC149E4739F9CCC5A64B3099718A794C338CAB4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 733a6bbd80c6e02a428de64e4dde48c1b5462693a0ea8cb76c2f9487ac166f83
MD5 b2af86f02aacbc32f668f9ef4e750341
SHA1 543664d2fe3118f9dab93ca46795207f6dc71254
SHA512 ba4822a9a2567a947ea314acd616659a8ca80259fcf76d0d413af36123ade19a83d323915ed4ffe3e62b001e253bf9c89dde323ebddd8a630d4504d81fae455a
TLSH
T1DB11F0A1B0F6CC93B031A4D7DB39D9C209D8639E64DC6A74730D8218A7948338DEA4E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 13KB
SHA256 7433584f6996250322b36ab7879d32228d857ce20e8d0c2e3fc55dc6a6442830
MD5 9b6fb203eaf7b666b6b6318389e6cae5
SHA1 ddb47b7ac225f6da93979c2a02a6155ca7b5c80d
SHA512 910a5fac4a7c83d45c8aab5e1dd91e163986f8f1390f1df02910ee4425cdcd8834b153d681f2ec178303e59da6a08d8418ca44bd8b43c90a96a6f623a7624924
SSDEEP 384:SmKEiPx/sq1IpwVDTQg8EiGhJ6kJ6kFRihdkA:SmEPx0q1VVDTb8MhJ6kJ6kFRih
TLSH
T12F52D3A1E0B6DC63F13169CB9739DAC249E4739F5CCC5A64B3099718A794C338CAB4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 14KB
SHA256 0b26d326085b1b2e8cbc62af4e9936329b87edef0e3219a9c370a8cf3b62c43b
MD5 ee07355feb25b4aef5b045282daaf39c
SHA1 d845960b94954b2b9ecc7b86d407b742ac542132
SHA512 6669baead6f3c54201216f8db469b2309b7f0ea622df40fb75373a40c0eb329342610ca204451f58ad9712dc62eddf8dd0f47cb29eeb0c8906de11087b01cfc4
SSDEEP 384:SmKEiPx/sq1IpwVDTQg8EiGhJ6kJ6kFRihdkxs1:SmEPx0q1VVDTb8MhJ6kJ6kFRiWs1
TLSH
T1B652D2A1E0B6DC63F13169CB9739DAC249E4739F5CCC5A64B3099718A794C338CAB4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 15KB
SHA256 d253b063998f0dc9ab4e707828dbbed59137c0eaff98381f62c914e94d02c8e9
MD5 9ce4f9072bc0c2d763abcba7f01195c8
SHA1 0f12b23dfc24c2cd0f851222d776e03c7f9aac92
SHA512 b42987c77c161e6b111d22004adfaa98fb828c4c05862d7a815933421e8bed547ccf4fc3b86cd1286cb2693a26d5a32b1b86006a6b6a095a9b0363516666487b
SSDEEP 384:SmKEiPx/sq1IpwVDTQg8EiGhJ6kJ6kFRihdkxsA2:SmEPx0q1VVDTb8MhJ6kJ6kFRiWsA2
TLSH
T1EE62F3A1E0B6DC63F13169CB9739DAC249E4739F5CCC5A64B3099718A794C338CAB4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 cfa0eafba56b5895b75abb8743a9dcc3677541b82c6463d3b2a8ec7cb34d605a
MD5 f291d2fcbeaf1f700fc4d1d1c90f53d6
SHA1 32dfeeeb50e72ab7087583426fde02d5887769fa
SHA512 1ccc1e893e35d05d59a300a0c57ad8ac4582d4035d954fdc39894f3e2cc798a40831a25adfc4032e6aa9f19275f843fd713e059bd8325e40d28cf2b49976f150
TLSH
T125310CE1B0B6DC93F03164D7DB3989C24AD4779F68DC5A7473098318A7859338DEA4E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 3579edc476acd724809fb804582e37d237d7abfda0cb6aea9e9869118561395b
MD5 36911ee9001a12df3cd78218c593ff7f
SHA1 9a923924373992ed338eba9f0ff8f32f2da64a0c
SHA512 423aa7a320743e4074e77928881d5ace161f6fe8465f72007a620f3ddecd303e54355a4d7d1d3ddde20e01bf6f928d439ecc9b53114b1ea509cd8e2dc4ccc438
TLSH
T116410BA1B0B6DC93F131A4C7DB39C9C24AD8739F58DC5A64730A8218A784933CCEE4E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 9748abe1eee5a57595393801a400ce4295d34d85461df5d4779a8f21521195d9
MD5 7073003f0cd7fec2b71b1089592bf6e5
SHA1 ca799fa2487c25bcc4bffdfd9e6988df0a9f8fed
SHA512 eb58f2886a9869e913529ffdb7e465a4cecb104313a325cc11872c044fd998a031d7e4400e7730a2030987c991db25ec066b2a863a838edc32bc076770baa015
TLSH
T16741A8A1B0B6DC93B131A4C7DB39D9C149D873AF58DC5A6473098218AB95933CCDE4D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 c8269bbfbfc3925fce435f32d86a97f49d92c649ac1dbb34815b32d2cdbff753
MD5 57c091f377ddb3259c533185a147679c
SHA1 828456f50148ddb042389e4bafac6f09df2ec0ba
SHA512 8d2349e2fb8d7112d8f9d5d0f77d93c4b014ef5befd576c927cb061c2541ff9d663c4ece7d48d34418ba4a6325af83b256b564355562fb5034b683e89b0dec4d
TLSH
T11F4186A1F0B6DCA3B131A4C7DB3999C14AD873AF58DC596473098218AB95933CCDE4D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 ac3116167b41858bb34a2125de655358b94ff37ee2fda3d36a6d429d85bb469e
MD5 1e01791600d4e262a47ab313f34be386
SHA1 396821cb6b7353799aa084a61a4f58ab4e7d4071
SHA512 216b82226fd0e7fbc67e8300d77e7eaa35ac54edb253b9253eb61d3d5658159b171e66b2d00e686df5a2f2ad317dbad3d09ced12f613a7ff49d1a83bb80d6660
TLSH
T11941A5A1F0B6DCA3B13194C7DB38DAD14A9873AF58DC5964730A8218AB94933CCDE4D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 6c1954a2eb7e9ce0c6f838944016e66098fb785ad43c9c92266a5f3191be8173
MD5 c0cec207a153913df6fce832fd89f392
SHA1 90432e7187602daf2651225f7c5e1d6c0d52ff69
SHA512 47780c253bb2e1109aa197dede2b9504846c081af353723c81eac4b319830d3f9ba32aa802c9c9e546d1bc7daeae38d47ff53456c4e9c66a24a46f01518bc916
TLSH
T14751B6A1F0B6DCA3B131A4C7DB39DAD149D873AF58DC5964730A8218AB94933CCDE4D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 48629e0cbdf10e9e64ab4141358b4d3a0398ff88a513c61ed4a4226213bac1e8
MD5 37700cc30d6fb9f8a9fcdb25037af49b
SHA1 78348673f6e9f1f9e87805dba59245a165d32861
SHA512 9bcae93c1ec0a7d59e040a86cb6d5627fc6942253daf9b764c5522ab38d5084e3a978e2f9a688a839dddbf1b6da541c46cf30a40c4cd59ca48843c92e56e420a
TLSH
T11B61BAA1F0B6DC93F131A4C7DB3999C14AD4736F5CDC5A6573098218AB94933CCEA4D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 3KB
SHA256 b1d750125309d3f9f9baa675b60638b4708963239ab95f088c2c54c28d922226
MD5 98fae7b1cdc7ffdadee0812af764bbca
SHA1 3771fff359ca6455119461425b020cf0ae7c80fe
SHA512 4752d28c0320ad5e84d26370fe040bb6b29eca3e0e63257d7c5910ff4711b6ab916f202dca1a2b4aa64a5f67a0036d0d9d201c1076f089b098dec9afcef73c7e
TLSH
T16761C9A1B0B6DCA3B131A4CBDB39D9C14AD473AF5CDC5A7573098218AB94933CCEA4D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 1201f79f2bff14159cf5ba9876fb94837e1c4d1107a76429275e17e6c66b5664
MD5 fc5a413485f5396eeeace0fbe80c3e26
SHA1 89fd40050e64790392d5be6adf59a73226cebc85
SHA512 6432b92353cb9525a68f111f821da86bb798d1581571ff0ea6ae3c25e5c737efbcadc3185f16b999e19d04f8b712ed620bb7157220ab84bac47b07efdc700833
SSDEEP 96:ojXwGXws1wz40Q1qt4ERbE+5+rVyId12+xF4+xcJfIP12A64ApJfWLuK/E:RzstLmKEChP7F/E
TLSH
T1A6A11AA1A0B6DC63F131A4CBDB3999C14AD473AF6CCC5A75B3098219A784933CCEB4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1172-47-0x00000000006F0000-0x0000000000712000-memory.dmp

Download

memory/1172-13-0x00000000006F0000-0x0000000000712000-memory.dmp

Download

memory/1636-422-0x0000000000BB0000-0x0000000000BD2000-memory.dmp

Download

memory/1636-326-0x0000000000BB0000-0x0000000000BD2000-memory.dmp

Download

memory/1800-467-0x0000000000470000-0x0000000000492000-memory.dmp

Download

memory/1828-595-0x0000000000260000-0x0000000000282000-memory.dmp

Download

memory/1828-840-0x0000000000260000-0x0000000000282000-memory.dmp

Download

memory/2116-593-0x0000000000B20000-0x0000000000B42000-memory.dmp

Download

memory/2116-673-0x0000000000B20000-0x0000000000B42000-memory.dmp

Download

memory/2308-424-0x00000000006C0000-0x00000000006E2000-memory.dmp

Download

memory/2308-328-0x00000000006C0000-0x00000000006E2000-memory.dmp

Download

memory/2396-292-0x0000000000140000-0x0000000000162000-memory.dmp

Download

memory/2908-665-0x0000000000830000-0x0000000000852000-memory.dmp

Download

memory/2908-591-0x0000000000830000-0x0000000000852000-memory.dmp

Download

memory/3084-647-0x0000000000AD0000-0x0000000000AF2000-memory.dmp

Download

memory/3084-866-0x0000000000AD0000-0x0000000000AF2000-memory.dmp

Download

memory/3908-48-0x00000000006F0000-0x0000000000712000-memory.dmp

Download

memory/3908-14-0x00000000006F0000-0x0000000000712000-memory.dmp

Download

memory/4056-300-0x00000000008B0000-0x00000000008D2000-memory.dmp

Download

memory/4064-521-0x0000000000B90000-0x0000000000BB2000-memory.dmp

Download

memory/4080-147-0x00000000005A0000-0x00000000005C2000-memory.dmp

Download

memory/4196-549-0x0000000000E70000-0x0000000000E92000-memory.dmp

Download

memory/4196-351-0x0000000000E70000-0x0000000000E92000-memory.dmp

Download

memory/4364-330-0x0000000000840000-0x0000000000862000-memory.dmp

Download

memory/4364-548-0x0000000000840000-0x0000000000862000-memory.dmp

Download

memory/4408-298-0x00000000008B0000-0x00000000008D2000-memory.dmp

Download

memory/4728-520-0x0000000000340000-0x0000000000362000-memory.dmp

Download

memory/4820-423-0x00000000006C0000-0x00000000006E2000-memory.dmp

Download

memory/4820-327-0x00000000006C0000-0x00000000006E2000-memory.dmp

Download

memory/4876-431-0x0000000000E70000-0x0000000000E92000-memory.dmp

Download

memory/4876-560-0x0000000000E70000-0x0000000000E92000-memory.dmp

Download

memory/4888-8-0x0000000000BA0000-0x0000000000BC2000-memory.dmp

Download

memory/4988-301-0x0000000000200000-0x0000000000222000-memory.dmp

Download

memory/5276-870-0x0000000000280000-0x00000000002A2000-memory.dmp

Download

memory/5284-95-0x0000000000340000-0x0000000000362000-memory.dmp

Download

memory/5284-49-0x0000000000340000-0x0000000000362000-memory.dmp

Download

memory/5448-193-0x0000000000580000-0x00000000005A2000-memory.dmp

Download

memory/5456-194-0x0000000000580000-0x00000000005A2000-memory.dmp

Download

memory/5460-869-0x0000000000280000-0x00000000002A2000-memory.dmp

Download

memory/5544-672-0x0000000000260000-0x0000000000282000-memory.dmp

Download

memory/5544-592-0x0000000000260000-0x0000000000282000-memory.dmp

Download

memory/5564-468-0x0000000000AF0000-0x0000000000B12000-memory.dmp

Download

memory/5568-146-0x00000000007F0000-0x0000000000812000-memory.dmp

Download

memory/5636-371-0x0000000000840000-0x0000000000862000-memory.dmp

Download

memory/5636-550-0x0000000000840000-0x0000000000862000-memory.dmp

Download

memory/5844-192-0x0000000000FA0000-0x0000000000FC2000-memory.dmp

Download

memory/5932-594-0x0000000000B20000-0x0000000000B42000-memory.dmp

Download

memory/5932-839-0x0000000000B20000-0x0000000000B42000-memory.dmp

Download

memory/5964-291-0x0000000000140000-0x0000000000162000-memory.dmp

Download

memory/5972-596-0x0000000000AD0000-0x0000000000AF2000-memory.dmp

Download

memory/5972-857-0x0000000000AD0000-0x0000000000AF2000-memory.dmp

Download

memory/6000-425-0x0000000000BB0000-0x0000000000BD2000-memory.dmp

Download

memory/6000-329-0x0000000000BB0000-0x0000000000BD2000-memory.dmp

Download

memory/6068-299-0x0000000000200000-0x0000000000222000-memory.dmp

Download

memory/6132-50-0x00000000003C0000-0x00000000003E2000-memory.dmp

Download

memory/6132-94-0x00000000003C0000-0x00000000003E2000-memory.dmp

Download

memory/6156-666-0x00000000005F0000-0x0000000000612000-memory.dmp

Download

memory/6164-667-0x00000000005F0000-0x0000000000612000-memory.dmp

Download

memory/6224-871-0x0000000000350000-0x0000000000372000-memory.dmp

Download

memory/6268-872-0x0000000000350000-0x0000000000372000-memory.dmp

Download

memory/6540-838-0x0000000000620000-0x0000000000642000-memory.dmp

Download

memory/6716-984-0x00000000009F0000-0x0000000000A12000-memory.dmp

Download

memory/6736-1014-0x0000000000980000-0x00000000009A2000-memory.dmp

Download

memory/6740-1013-0x0000000000980000-0x00000000009A2000-memory.dmp

Download