Overview

overview

10

Static

static

10

2026-07-04...ar.exe

windows10-2004-x64

10

2026-07-04...ar.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    90s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 00:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-04_af16937cee5ccf41f0913c101d2111b9_akira_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe
  • Size 2.6MB
  • Sample260705-apla4afv8z
  • SHA256 799ca87d2d265e95114b6aa4da95192e07eec2da71d5d133704b6cfc541446ec
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
earth_pretamustang_pandaadwarediscoveryexecutionpubloadloaderpersistenceransomwarespyware

Malware Config

Signatures

  • Family: PUBLOAD, ClaimLoader, NoFive

    PUBLOAD is a shellcode loader used by Mustang Panda APT.

    loaderpubload
  • Detects ClaimLoader loader 1 IoCs
    loadermustang_pandaearth_preta
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 11 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Launches sc.exe 38 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 19 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 52 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-04_af16937cee5ccf41f0913c101d2111b9_akira_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-04_af16937cee5ccf41f0913c101d2111b9_akira_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5964
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCBACBBCABCCBBCAACACBAAAAAABCABACBCBABBCCACBBBBCCCBBAABCCCCBACCCBCACAAABABABACCCABCCCCAACCBACCCBCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABACABCACABBBABABBAABABACBAACCCCACBCABABBACBCACBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5836
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCBACBBCABCCBBCAACACBAAAAAABCABACBCBABBCCACBBBBCCCBBAABCCCCBACCCBCACAAABABABACCCABCCCCAACCBACCCBCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABACABCACABBBABABBAABABACBAACCCCACBCABABBACBCACBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:956
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCCAACABABBBBBACCBBBCABCBABCCACBBCACBAAABBBCCCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABACABCACABBBABABBAABABACBAACCCCACBCABABBACBCACBCCA.exe" start= auto displayName= "UserDataSvc_CBBCCAACABABBBBBACCBBBCABCBABCCACBBCACBAAABBBCCCABB"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1492
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_CBBCCAACABABBBBBACCBBBCABCBABCCACBBCACBAAABBBCCCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABACABCACABBBABABBAABABACBAACCCCACBCABABBACBCACBCCA.exe" start= auto displayName= "UserDataSvc_CBBCCAACABABBBBBACCBBBCABCBABCCACBBCACBAAABBBCCCABB"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4012
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCCAACABABBBBBACCBBBCABCBABCCACBBCACBAAABBBCCCABB"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4988
      • C:\Windows\SysWOW64\sc.exe
        sc start "UserDataSvc_CBBCCAACABABBBBBACCBBBCABCBABCCACBBCACBAAABBBCCCABB"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3440
  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABACABCACABBBABABBAABABACBAACCCCACBCABABBACBCACBCCA.exe
    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABACABCACABBBABABBAABABACBAACCCCACBCABABBACBCACBCCA.exe
    1⤵
    • Drops startup file
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1932
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACBCBABCBAABAACCCCBCCCABCCBCCCCAABABBCABCACACCBCAACBACBBABBBACACBBACCCCCABCCCBBBAAABBACAAABABCAABBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBACBCBACBCCAABACCCAAAAABCBABABABBABBBCACCCAACCAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4620
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACBCBABCBAABAACCCCBCCCABCCBCCCCAABABBCABCACACCBCAACBACBBABBBACACBBACCCCCABCCCBBBAAABBACAAABABCAABBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBACBCBACBCCAABACCCAAAAABCBABABABBABBBCACCCAACCAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2828
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACBBBAABCCBAABCCCBBCCCCAACBCCCBCBAACCBABABCCBACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBACBCBACBCCAABACCCAAAAABCBABABABBABBBCACCCAACCAAACB.exe" start= auto displayName= "UserDataSvc_BAACBBBAABCCBAABCCCBBCCCCAACBCCCBCBAACCBABABCCBACCC"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4176
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_BAACBBBAABCCBAABCCCBBCCCCAACBCCCBCBAACCBABABCCBACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBACBCBACBCCAABACCCAAAAABCBABABABBABBBCACCCAACCAAACB.exe" start= auto displayName= "UserDataSvc_BAACBBBAABCCBAABCCCBBCCCCAACBCCCBCBAACCBABABCCBACCC"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:5620
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACBBBAABCCBAABCCCBBCCCCAACBCCCBCBAACCBABABCCBACCC"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5492
      • C:\Windows\SysWOW64\sc.exe
        sc start "UserDataSvc_BAACBBBAABCCBAABCCCBBCCCCAACBCCCBCBAACCBABABCCBACCC"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:5820
  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABACABCACABBBABABBAABABACBAACCCCACBCABABBACBCACBCCA.exe
    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABACABCACABBBABABBAABABACBAACCCCACBCABABBACBCACBCCA.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5240
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACCBCCCBACABACCBCCBBCAAAACCBCACAAACBAABCCCCBBACBCCBBBCAACBBCCAACACCABCCAAABBBBCCACBCABACBBABBCCABCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBABABABACCACCCCBBABCABAABBCBCBCBBBBBAACAACABCAAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1240
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACCBCCCBACABACCBCCBBCAAAACCBCACAAACBAABCCCCBBACBCCBBBCAACBBCCAACACCABCCAAABBBBCCACBCABACBBABBCCABCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBABABABACCACCCCBBABCABAABBCBCBCBBBBBAACAACABCAAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2592
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAACCACBCCCABCCAACACABBACBCCBABCBCCBACCBBBCCACCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBABABABACCACCCCBBABCABAABBCBCBCBBBBBAACAACABCAAAAAB.exe" start= auto displayName= "UserDataSvc_CBAACCACBCCCABCCAACACABBACBCCBABCBCCBACCBBBCCACCACA"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4564
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_CBAACCACBCCCABCCAACACABBACBCCBABCBCCBACCBBBCCACCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBABABABACCACCCCBBABCABAABBCBCBCBBBBBAACAACABCAAAAAB.exe" start= auto displayName= "UserDataSvc_CBAACCACBCCCABCCAACACABBACBCCBABCBCCBACCBBBCCACCACA"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3388
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAACCACBCCCABCCAACACABBACBCCBABCBCCBACCBBBCCACCACA"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:624
      • C:\Windows\SysWOW64\sc.exe
        sc start "UserDataSvc_CBAACCACBCCCABCCAACACABBACBCCBABCBCCBACCBBBCCACCACA"
        3⤵
        • Launches sc.exe
        PID:3008
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4184
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:6052
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1668
  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBABABABACCACCCCBBABCABAABBCBCBCBBBBBAACAACABCAAAAAB.exe
    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBABABABACCACCCCBBABCABAABBCBCBCBBBBBAACAACABCAAAAAB.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3780
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBABABCCABABAABBACABCACBCBCBAABCACCACCBBCCCAAAABAAABCCABBBAACAABCABCCBABACAAACAAAACCACBBBCABCACBACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBCCCBCABBBAABBBCCBACCACACCCABAABACCBABCAAABBCBCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3968
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBABABCCABABAABBACABCACBCBCBAABCACCACCBBCCCAAAABAAABCCABBBAACAABCABCCBABACAAACAAAACCACBBBCABCACBACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBCCCBCABBBAABBBCCBACCACACCCABAABACCBABCAAABBCBCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3148
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCACBAACCBBACAAAAAABBBBAABCBAABCABBCBBACBAACABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBCCCBCABBBAABBBCCBACCACACCCABAABACCBABCAAABBCBCCAB.exe" start= auto displayName= "UserDataSvc_AABCACBAACCBBACAAAAAABBBBAABCBAABCABBCBBACBAACABBCC"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1356
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_AABCACBAACCBBACAAAAAABBBBAABCBAABCABBCBBACBAACABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBCCCBCABBBAABBBCCBACCACACCCABAABACCBABCAAABBCBCCAB.exe" start= auto displayName= "UserDataSvc_AABCACBAACCBBACAAAAAABBBBAABCBAABCABBCBBACBAACABBCC"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4292
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCACBAACCBBACAAAAAABBBBAABCBAABCABBCBBACBAACABBCC"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3460
      • C:\Windows\SysWOW64\sc.exe
        sc start "UserDataSvc_AABCACBAACCBBACAAAAAABBBBAABCBAABCABBCBBACBAACABBCC"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4012
  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBACBCBACBCCAABACCCAAAAABCBABABABBABBBCACCCAACCAAACB.exe
    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBACBCBACBCCAABACCCAAAAABCBABABABBABBBCACCCAACCAAACB.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3372
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAACCACAABCCAACABBBACCCAAACABCBABCCBABBBBCCCABCCCAABABBACCBCBBBCABCBBCCBCBBABBABCCCCCAAABCCBAACCCAAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACBBCBBBCCBCBBCBAAAABACBCBBAACBBCBCAAABACAACABAAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5984
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAACCACAABCCAACABBBACCCAAACABCBABCCBABBBBCCCABCCCAABABBACCBCBBBCABCBBCCBCBBABBABCCCCCAAABCCBAACCCAAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACBBCBBBCCBCBBCBAAAABACBCBBAACBBCBCAAABACAACABAAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2152
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACCCCAACCBBACBCBAABCCAABABACCACBCCCBABCAABCBBCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACBBCBBBCCBCBBCBAAAABACBCBBAACBBCBCAAABACAACABAAABCA.exe" start= auto displayName= "UserDataSvc_CCACCCCAACCBBACBCBAABCCAABABACCACBCCCBABCAABCBBCCCA"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_CCACCCCAACCBBACBCBAABCCAABABACCACBCCCBABCAABCBBCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACBBCBBBCCBCBBCBAAAABACBCBBAACBBCBCAAABACAACABAAABCA.exe" start= auto displayName= "UserDataSvc_CCACCCCAACCBBACBCBAABCCAABABACCACBCCCBABCAABCBBCCCA"
        3⤵
        • Launches sc.exe
        PID:3212
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACCCCAACCBBACBCBAABCCAABABACCACBCCCBABCAABCBBCCCA"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4212
      • C:\Windows\SysWOW64\sc.exe
        sc start "UserDataSvc_CCACCCCAACCBBACBCBAABCCAABABACCACBCCCBABCAABCBBCCCA"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4152
  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBCCCBCABBBAABBBCCBACCACACCCABAABACCBABCAAABBCBCCAB.exe
    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBCCCBCABBBAABBBCCBACCACACCCABAABACCBABCAAABBCBCCAB.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3768
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCABBACABBABBCAAAABACCBBABCCCBCBCCABAABBACBBBCAABBCBBCBBBBAAABCCCBCBAACCABAAACACBABBABCACBBBCBCBCAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABBACABBABBCAAAABACCBBABCCCBCBCCABAABBACBBBCAABBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4752
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCABBACABBABBCAAAABACCBBABCCCBCBCCABAABBACBBBCAABBCBBCBBBBAAABCCCBCBAACCABAAACACBABBABCACBBBCBCBCAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABBACABBABBCAAAABACCBBABCCCBCBCCABAABBACBBBCAABBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2340
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBBCCACCBACBBACCACCABBABBBBABAAACCCAABCAACCBABBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABBACABBABBCAAAABACCBBABCCCBCBCCABAABBACBBBCAABBCBB.exe" start= auto displayName= "UserDataSvc_ACCBBCCACCBACBBACCACCABBABBBBABAAACCCAABCAACCBABBCB"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4892
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_ACCBBCCACCBACBBACCACCABBABBBBABAAACCCAABCAACCBABBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABBACABBABBCAAAABACCBBABCCCBCBCCABAABBACBBBCAABBCBB.exe" start= auto displayName= "UserDataSvc_ACCBBCCACCBACBBACCACCABBABBBBABAAACCCAABCAACCBABBCB"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3312
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBBCCACCBACBBACCACCABBABBBBABAAACCCAABCAACCBABBCB"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3452
      • C:\Windows\SysWOW64\sc.exe
        sc start "UserDataSvc_ACCBBCCACCBACBBACCACCABBABBBBABAAACCCAABCAACCBABBCB"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4616
  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACBBCBBBCCBCBBCBAAAABACBCBBAACBBCBCAAABACAACABAAABCA.exe
    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACBBCBBBCCBCBBCBAAAABACBCBBAACBBCBCAAABACAACABAAABCA.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3380
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABAACCBCCBBBBABBCCCCBABBBCBABBACBBBBCCCAAABCAABBCCABCCCBCBBACCCACBBBCBCCCBCCBCCBBBABCBACCCACABBAACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBABCBACACCAAAACBBBBBBCCAABBABBCCBBCBCCACBACCBACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3588
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABAACCBCCBBBBABBCCCCBABBBCBABBACBBBBCCCAAABCAABBCCABCCCBCBBACCCACBBBCBCCCBCCBCCBBBABCBACCCACABBAACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBABCBACACCAAAACBBBBBBCCAABBABBCCBBCBCCACBACCBACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:1640
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCABABBCCABABABBBCCCAABCAACAABCAABBBACBBCCACCCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBABCBACACCAAAACBBBBBBCCAABBABBCCBBCBCCACBACCBACBAC.exe" start= auto displayName= "UserDataSvc_CBCCABABBCCABABABBBCCCAABCAACAABCAABBBACBBCCACCCBCB"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2424
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_CBCCABABBCCABABABBBCCCAABCAACAABCAABBBACBBCCACCCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBABCBACACCAAAACBBBBBBCCAABBABBCCBBCBCCACBACCBACBAC.exe" start= auto displayName= "UserDataSvc_CBCCABABBCCABABABBBCCCAABCAACAABCAABBBACBBCCACCCBCB"
        3⤵
        • Launches sc.exe
        PID:4536
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCABABBCCABABABBBCCCAABCAACAABCAABBBACBBCCACCCBCB"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4608
      • C:\Windows\System32\Conhost.exe
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        3⤵
          PID:2592
        • C:\Windows\SysWOW64\sc.exe
          sc start "UserDataSvc_CBCCABABBCCABABABBBCCCAABCAACAABCAABBBACBBCCACCCBCB"
          3⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:4376
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABBACABBABBCAAAABACCBBABCCCBCBCCABAABBACBBBCAABBCBB.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABBACABBABBCAAAABACCBBABCCCBCBCCABAABBACBBBCAABBCBB.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAABCAABABCABCABAAACBBABBAACBABBACBCCACCCAABBBCCCCBACAABCAAACABABCBCACCCCCCCCACCCCABBBABCAACAACCAACACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABCAABABCABCABAAACBBABBAACBABBACBCCACCCAABBBCCCCBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5840
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAABCAABABCABCABAAACBBABBAACBABBACBCCACCCAABBBCCCCBACAABCAAACABABCBCACCCCCCCCACCCCABBBABCAACAACCAACACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABCAABABCABCABAAACBBABBAACBABBACBCCACCCAABBBCCCCBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:5860
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACBCCAABCCBBBABACCAABAABCBBCBAAABBBCCABCCABACAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABCAABABCABCABAAACBBABBAACBABBACBCCACCCAABBBCCCCBACA.exe" start= auto displayName= "UserDataSvc_CCACBCCAABCCBBBABACCAABAABCBBCBAAABBBCCABCCABACAACB"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1352
        • C:\Windows\SysWOW64\sc.exe
          sc create "UserDataSvc_CCACBCCAABCCBBBABACCAABAABCBBCBAAABBBCCABCCABACAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABCAABABCABCABAAACBBABBAACBABBACBCCACCCAABBBCCCCBACA.exe" start= auto displayName= "UserDataSvc_CCACBCCAABCCBBBABACCAABAABCBBCBAAABBBCCABCCABACAACB"
          3⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:3148
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACBCCAABCCBBBABACCAABAABCBBCBAAABBBCCABCCABACAACB"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5212
        • C:\Windows\SysWOW64\sc.exe
          sc start "UserDataSvc_CCACBCCAABCCBBBABACCAABAABCBBCBAAABBBCCABCCABACAACB"
          3⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1004
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBABCBACACCAAAACBBBBBBCCAABBABBCCBBCBCCACBACCBACBAC.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBABCBACACCAAAACBBBBBBCCAABBABBCCBBCBCCACBACCBACBAC.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5552
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCCCBBCACABCAAABBCBAABBCCBACABBBBBAABCCCAAABAAAABCCACCCCBAAABACBCBABCBBABCAABBBCCBBBACCBABCCABCBACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCBBCACABCAAABBCBAABBCCBACABBBBBAABCCCAAABAAAABCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2152
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCCCBBCACABCAAABBCBAABBCCBACABBBBBAABCCCAAABAAAABCCACCCCBAAABACBCBABCBBABCAABBBCCBBBACCBABCCABCBACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCBBCACABCAAABBCBAABBCCBACABBBBBAABCCCAAABAAAABCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:2488
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACCABAAAACBAACBCAABACBBCBAAACCAAACACCCBACABABAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCBBCACABCAAABBCBAABBCCBACABBBBBAABCCCAAABAAAABCCAC.exe" start= auto displayName= "UserDataSvc_CCACCABAAAACBAACBCAABACBBCBAAACCAAACACCCBACABABAAAC"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3228
        • C:\Windows\SysWOW64\sc.exe
          sc create "UserDataSvc_CCACCABAAAACBAACBCAABACBBCBAAACCAAACACCCBACABABAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCBBCACABCAAABBCBAABBCCBACABBBBBAABCCCAAABAAAABCCAC.exe" start= auto displayName= "UserDataSvc_CCACCABAAAACBAACBCAABACBBCBAAACCAAACACCCBACABABAAAC"
          3⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:2224
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACCABAAAACBAACBCAABACBBCBAAACCAAACACCCBACABABAAAC"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2092
        • C:\Windows\SysWOW64\sc.exe
          sc start "UserDataSvc_CCACCABAAAACBAACBCAABACBBCBAAACCAAACACCCBACABABAAAC"
          3⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1060
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABCAABABCABCABAAACBBABBAACBABBACBCCACCCAABBBCCCCBACA.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABCAABABCABCABAAACBBABBAACBABBACBCCACCCAABBBCCCCBACA.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5996
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCCCBAAAACAABCCABACACBACBBCBBBCCACABCBACBCBAAABCBCACCBACCBCCCCBBCCCABBABCCBABBCBBAABACAACBACAAACBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBAAAACAABCCABACACBACBBCBBBCCACABCBACBCBAAABCBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4336
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCCCBAAAACAABCCABACACBACBBCBBBCCACABCBACBCBAAABCBCACCBACCBCCCCBBCCCABBABCCBABBCBBAABACAACBACAAACBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBAAAACAABCCABACACBACBBCBBBCCACABCBACBCBAAABCBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:3312
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACCCACCCBBABBCACCBBABBACBACACCCCBBBBBBABCBACBBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBAAAACAABCCABACACBACBBCBBBCCACABCBACBCBAAABCBCAC.exe" start= auto displayName= "UserDataSvc_CBACCCACCCBBABBCACCBBABBACBACACCCCBBBBBBABCBACBBAAC"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4528
        • C:\Windows\SysWOW64\sc.exe
          sc create "UserDataSvc_CBACCCACCCBBABBCACCBBABBACBACACCCCBBBBBBABCBACBBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBAAAACAABCCABACACBACBBCBBBCCACABCBACBCBAAABCBCAC.exe" start= auto displayName= "UserDataSvc_CBACCCACCCBBABBCACCBBABBACBACACCCCBBBBBBABCBACBBAAC"
          3⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1216
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACCCACCCBBABBCACCBBABBACBACACCCCBBBBBBABCBACBBAAC"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2024
        • C:\Windows\SysWOW64\sc.exe
          sc start "UserDataSvc_CBACCCACCCBBABBCACCBBABBACBACACCCCBBBBBBABCBACBBAAC"
          3⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:3176
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCBBCACABCAAABBCBAABBCCBACABBBBBAABCCCAAABAAAABCCAC.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCBBCACABCAAABBCBAABBCCBACABBBBBAABCCCAAABAAAABCCAC.exe
      1⤵
      • Executes dropped EXE
      PID:5044
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBCCBAACBCCCABCCBBBBAAABBBACBBBACCBBACCAABBBAAAACBAAACCCBABBBBBCCBABCBBBACCBAACABAAAACCAACABCCBBBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCCBAACBCCCABCCBBBBAAABBBACBBBACCBBACCAABBBAAAACBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
        2⤵
          PID:4080
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBCCBAACBCCCABCCBBBBAAABBBACBBBACCBBACCAABBBAAAACBAAACCCBABBBBBCCBABCBBBACCBAACABAAAACCAACABCCBBBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCCBAACBCCCABCCBBBBAAABBBACBBBACCBBACCAABBBAAAACBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2396
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACBACCBABCBBBCABBBBBCBCACAABCBBBBBABCCACAABBCCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCCBAACBCCCABCCBBBBAAABBBACBBBACCBBACCAABBBAAAACBAA.exe" start= auto displayName= "UserDataSvc_BCACBACCBABCBBBCABBBBBCBCACAABCBBBBBABCCACAABBCCCAB"
          2⤵
            PID:5484
            • C:\Windows\SysWOW64\sc.exe
              sc create "UserDataSvc_BCACBACCBABCBBBCABBBBBCBCACAABCBBBBBABCCACAABBCCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCCBAACBCCCABCCBBBBAAABBBACBBBACCBBACCAABBBAAAACBAA.exe" start= auto displayName= "UserDataSvc_BCACBACCBABCBBBCABBBBBCBCACAABCBBBBBABCCACAABBCCCAB"
              3⤵
              • Launches sc.exe
              PID:1864
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACBACCBABCBBBCABBBBBCBCACAABCBBBBBABCCACAABBCCCAB"
            2⤵
              PID:3276
              • C:\Windows\SysWOW64\sc.exe
                sc start "UserDataSvc_BCACBACCBABCBBBCABBBBBCBCACAABCBBBBBABCCACAABBCCCAB"
                3⤵
                • Launches sc.exe
                PID:4092
          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBAAAACAABCCABACACBACBBCBBBCCACABCBACBCBAAABCBCAC.exe
            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBAAAACAABCCABACACBACBBCBBBCCACABCBACBCBAAABCBCAC.exe
            1⤵
            • Executes dropped EXE
            PID:4868
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBABAABBCCABABABCCAAABBBACAACCCCBBBBCCAABCBCCACAACCCBCAABBABCCABAACACCAAACCBBABBACACBBABBAACABCAACCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABAABBCCABABABCCAAABBBACAACCCCBBBBCCAABCBCCACAACCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
              2⤵
                PID:3672
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBABAABBCCABABABCCAAABBBACAACCCCBBBBCCAABCBCCACAACCCBCAABBABCCABAACACCAAACCBBABBACACBBABBAACABCAACCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABAABBCCABABABCCAAABBBACAACCCCBBBBCCAABCBCCACAACCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                  3⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:2448
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAACCCCABBCAACCBBCBAACBAAACABCAACCBBCCCBAAACACBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABAABBCCABABABCCAAABBBACAACCCCBBBBCCAABCBCCACAACCCBC.exe" start= auto displayName= "UserDataSvc_BCAACCCCABBCAACCBBCBAACBAAACABCAACCBBCCCBAAACACBBBA"
                2⤵
                  PID:3028
                  • C:\Windows\SysWOW64\sc.exe
                    sc create "UserDataSvc_BCAACCCCABBCAACCBBCBAACBAAACABCAACCBBCCCBAAACACBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABAABBCCABABABCCAAABBBACAACCCCBBBBCCAABCBCCACAACCCBC.exe" start= auto displayName= "UserDataSvc_BCAACCCCABBCAACCBBCBAACBAAACABCAACCBBCCCBAAACACBBBA"
                    3⤵
                    • Launches sc.exe
                    PID:3704
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAACCCCABBCAACCBBCBAACBAAACABCAACCBBCCCBAAACACBBBA"
                  2⤵
                    PID:4028
                    • C:\Windows\SysWOW64\sc.exe
                      sc start "UserDataSvc_BCAACCCCABBCAACCBBCBAACBAAACABCAACCBBCCCBAAACACBBBA"
                      3⤵
                      • Launches sc.exe
                      PID:1908
                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCCBAACBCCCABCCBBBBAAABBBACBBBACCBBACCAABBBAAAACBAA.exe
                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCCBAACBCCCABCCBBBBAAABBBACBBBACCBBACCAABBBAAAACBAA.exe
                  1⤵
                    PID:5820
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCABCACBBCACCACBABCCBCABABAABAABCCCABACCACBCCACCCCBCCBACCAABACAACBCCABABBCBCCACBABACBBCABABBAACBAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCCBCCCAACCBACBABBBAABAAABACABBACCBACBAACBBCCCCCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
                      2⤵
                        PID:4420
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCABCACBBCACCACBABCCBCABABAABAABCCCABACCACBCCACCCCBCCBACCAABACAACBCCABABBCBCCACBABACBBCABABBAACBAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCCBCCCAACCBACBABBBAABAAABACABBACCBACBAACBBCCCCCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
                          3⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:3148
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBABBABBBCBCBACAABABBBCCBCAAAABAABBBCCCBABACCBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCCBCCCAACCBACBABBBAABAAABACABBACCBACBAACBBCCCCCACB.exe" start= auto displayName= "UserDataSvc_CACBABBABBBCBCBACAABABBBCCBCAAAABAABBBCCCBABACCBABB"
                        2⤵
                          PID:2220
                          • C:\Windows\SysWOW64\sc.exe
                            sc create "UserDataSvc_CACBABBABBBCBCBACAABABBBCCBCAAAABAABBBCCCBABACCBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCCBCCCAACCBACBABBBAABAAABACABBACCBACBAACBBCCCCCACB.exe" start= auto displayName= "UserDataSvc_CACBABBABBBCBCBACAABABBBCCBCAAAABAABBBCCCBABACCBABB"
                            3⤵
                            • Launches sc.exe
                            PID:2440
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBABBABBBCBCBACAABABBBCCBCAAAABAABBBCCCBABACCBABB"
                          2⤵
                            PID:5752
                            • C:\Windows\SysWOW64\sc.exe
                              sc start "UserDataSvc_CACBABBABBBCBCBACAABABBBCCBCAAAABAABBBCCCBABACCBABB"
                              3⤵
                              • Launches sc.exe
                              PID:2036
                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABAABBCCABABABCCAAABBBACAACCCCBBBBCCAABCBCCACAACCCBC.exe
                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABAABBCCABABABCCAAABBBACAACCCCBBBBCCAABCBCCACAACCCBC.exe
                          1⤵
                            PID:4012
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBBCBCABACCBACBAAACAAACBCACBACCBAACCAAAACCCACCBCCAABCCCCABCCACCABCBACCCCABBAACCAAAACACBCABCCCCCBACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBAABACCBCAAABBACBCBBCACCACBBCCAACCBBCCCBBABBBBBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                              2⤵
                                PID:4804
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBBCBCABACCBACBAAACAAACBCACBACCBAACCAAAACCCACCBCCAABCCCCABCCACCABCBACCCCABBAACCAAAACACBCABCCCCCBACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBAABACCBCAAABBACBCBBCACCACBBCCAACCBBCCCBBABBBBBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                  3⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:3576
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAAACCAACBABBBBCAABCBBACBACBACBAAAACACACCAABBACCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBAABACCBCAAABBACBCBBCACCACBBCCAACCBBCCCBBABBBBBACBA.exe" start= auto displayName= "UserDataSvc_CAAAACCAACBABBBBCAABCBBACBACBACBAAAACACACCAABBACCAC"
                                2⤵
                                  PID:2312
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc create "UserDataSvc_CAAAACCAACBABBBBCAABCBBACBACBACBAAAACACACCAABBACCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBAABACCBCAAABBACBCBBCACCACBBCCAACCBBCCCBBABBBBBACBA.exe" start= auto displayName= "UserDataSvc_CAAAACCAACBABBBBCAABCBBACBACBACBAAAACACACCAABBACCAC"
                                    3⤵
                                    • Launches sc.exe
                                    PID:5912
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAAACCAACBABBBBCAABCBBACBACBACBAAAACACACCAABBACCAC"
                                  2⤵
                                    PID:3932
                                    • C:\Windows\SysWOW64\sc.exe
                                      sc start "UserDataSvc_CAAAACCAACBABBBBCAABCBBACBACBACBAAAACACACCAABBACCAC"
                                      3⤵
                                      • Launches sc.exe
                                      PID:5084
                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCCBCCCAACCBACBABBBAABAAABACABBACCBACBAACBBCCCCCACB.exe
                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCCBCCCAACCBACBABBBAABAAABACABBACCBACBAACBBCCCCCACB.exe
                                  1⤵
                                    PID:3328
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAABBBBCBACBCBCCBCCBCABCABCCCAAACBABCBBABCAACCBABBAAABABCAAAAAAAAABBBAABCBCBBCAABBBCABBBACBBCACACCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAAABCCBACCAABCCBCCACCAABBCABACABCCCCABAACBACCCAABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                      2⤵
                                        PID:2892
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAABBBBCBACBCBCCBCCBCABCABCCCAAACBABCBBABCAACCBABBAAABABCAAAAAAAAABBBAABCBCBBCAABBBCABBBACBBCACACCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAAABCCBACCAABCCBCCACCAABBCABACABCCCCABAACBACCCAABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                          3⤵
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3060
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCACAACACBCCBCBCABBABACABCABBCCBAAAABCABCACCAAAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAAABCCBACCAABCCBCCACCAABBCABACABCCCCABAACBACCCAABAA.exe" start= auto displayName= "UserDataSvc_ABCACAACACBCCBCBCABBABACABCABBCCBAAAABCABCACCAAAAAB"
                                        2⤵
                                          PID:4816
                                          • C:\Windows\SysWOW64\sc.exe
                                            sc create "UserDataSvc_ABCACAACACBCCBCBCABBABACABCABBCCBAAAABCABCACCAAAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAAABCCBACCAABCCBCCACCAABBCABACABCCCCABAACBACCCAABAA.exe" start= auto displayName= "UserDataSvc_ABCACAACACBCCBCBCABBABACABCABBCCBAAAABCABCACCAAAAAB"
                                            3⤵
                                            • Launches sc.exe
                                            PID:2340
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCACAACACBCCBCBCABBABACABCABBCCBAAAABCABCACCAAAAAB"
                                          2⤵
                                            PID:2008
                                            • C:\Windows\SysWOW64\sc.exe
                                              sc start "UserDataSvc_ABCACAACACBCCBCBCABBABACABCABBCCBAAAABCABCACCAAAAAB"
                                              3⤵
                                              • Launches sc.exe
                                              PID:4084
                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBAABACCBCAAABBACBCBBCACCACBBCCAACCBBCCCBBABBBBBACBA.exe
                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBAABACCBCAAABBACBCBBCACCACBBCCAACCBBCCCBBABBBBBACBA.exe
                                          1⤵
                                            PID:2984
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABBBBBACBACCCBBBCCAABBACCBCBCCCBCCCCACACCBBCABABABCBBCBACABBBAAACACCBCCABBCCAAAABCABBCCBCCCCACBCBBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBBBBACBACCCBBBCCAABBACCBCBCCCBCCCCACACCBBCABABABCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                              2⤵
                                                PID:3432
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABBBBBACBACCCBBBCCAABBACCBCBCCCBCCCCACACCBBCABABABCBBCBACABBBAAACACCBCCABBCCAAAABCABBCCBCCCCACBCBBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBBBBACBACCCBBBCCAABBACCBCBCCCBCCCCACACCBBCABABABCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                  3⤵
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1792
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCAAABACCCCAABBCCCBBACAAAACCCCBABCAAABACABCBBBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBBBBACBACCCBBBCCAABBACCBCBCCCBCCCCACACCBBCABABABCBB.exe" start= auto displayName= "UserDataSvc_CCCCAAABACCCCAABBCCCBBACAAAACCCCBABCAAABACABCBBBBAC"
                                                2⤵
                                                  PID:2216
                                                  • C:\Windows\SysWOW64\sc.exe
                                                    sc create "UserDataSvc_CCCCAAABACCCCAABBCCCBBACAAAACCCCBABCAAABACABCBBBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBBBBACBACCCBBBCCAABBACCBCBCCCBCCCCACACCBBCABABABCBB.exe" start= auto displayName= "UserDataSvc_CCCCAAABACCCCAABBCCCBBACAAAACCCCBABCAAABACABCBBBBAC"
                                                    3⤵
                                                    • Launches sc.exe
                                                    PID:5000
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCAAABACCCCAABBCCCBBACAAAACCCCBABCAAABACABCBBBBAC"
                                                  2⤵
                                                    PID:4024
                                                    • C:\Windows\SysWOW64\sc.exe
                                                      sc start "UserDataSvc_CCCCAAABACCCCAABBCCCBBACAAAACCCCBABCAAABACABCBBBBAC"
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:4704
                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAAABCCBACCAABCCBCCACCAABBCABACABCCCCABAACBACCCAABAA.exe
                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABAAABCCBACCAABCCBCCACCAABBCABACABCCCCABAACBACCCAABAA.exe
                                                  1⤵
                                                    PID:3960
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAABCAACABBCBAACBAAAACCBBABBCCCBBBBCBACCBAACCBBCBAABCACAAACBBCBBCCCABAABABCCCABCBAAABBCCBCCBBAAACBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAABBACBBCBBCCAABABAAAABCAACCCCBCBABABBBCCACCCBAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                      2⤵
                                                        PID:5424
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAABCAACABBCBAACBAAAACCBBABBCCCBBBBCBACCBAACCBBCBAABCACAAACBBCBBCCCABAABABCCCABCBAAABBCCBCCBBAAACBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAABBACBBCBBCCAABABAAAABCAACCCCBCBABABBBCCACCCBAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                          3⤵
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:1708
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCCABAABBABCCBCABCCCACBCBABAABBCBBBCBBBACCABCBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAABBACBBCBBCCAABABAAAABCAACCCCBCBABABBBCCACCCBAAAC.exe" start= auto displayName= "UserDataSvc_CBCCCABAABBABCCBCABCCCACBCBABAABBCBBBCBBBACCABCBBAB"
                                                        2⤵
                                                          PID:4020
                                                          • C:\Windows\SysWOW64\sc.exe
                                                            sc create "UserDataSvc_CBCCCABAABBABCCBCABCCCACBCBABAABBCBBBCBBBACCABCBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAABBACBBCBBCCAABABAAAABCAACCCCBCBABABBBCCACCCBAAAC.exe" start= auto displayName= "UserDataSvc_CBCCCABAABBABCCBCABCCCACBCBABAABBCBBBCBBBACCABCBBAB"
                                                            3⤵
                                                            • Launches sc.exe
                                                            PID:3000
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCCABAABBABCCBCABCCCACBCBABAABBCBBBCBBBACCABCBBAB"
                                                          2⤵
                                                            PID:4060
                                                            • C:\Windows\SysWOW64\sc.exe
                                                              sc start "UserDataSvc_CBCCCABAABBABCCBCABCCCACBCBABAABBCBBBCBBBACCABCBBAB"
                                                              3⤵
                                                              • Launches sc.exe
                                                              PID:2468
                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBBBBACBACCCBBBCCAABBACCBCBCCCBCCCCACACCBBCABABABCBB.exe
                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBBBBACBACCCBBBCCAABBACCBCBCCCBCCCCACACCBBCABABABCBB.exe
                                                          1⤵
                                                            PID:2388
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABACABBBACCACBCCACCAACAACABAAACBAAACAACBBABAABABCABBACBABBAAABCBABACCACCABCCBCBBBABBCACCAACCCBABAACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBCCAABBBABBBACBAAABABBCBBCCCCBCCCAABACBBBABCCACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                              2⤵
                                                                PID:5264
                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABACABBBACCACBCCACCAACAACABAAACBAAACAACBBABAABABCABBACBABBAAABCBABACCACCABCCBCBBBABBCACCAACCCBABAACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBCCAABBBABBBACBAAABABBCBBCCCCBCCCAABACBBBABCCACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                  3⤵
                                                                  • Scheduled Task/Job: Scheduled Task
                                                                  PID:4272
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCCBBCBBCBCACBCACAAAABBAACAAABBCABCCACABCCBBAACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBCCAABBBABBBACBAAABABBCBBCCCCBCCCAABACBBBABCCACBCA.exe" start= auto displayName= "UserDataSvc_BACCCBBCBBCBCACBCACAAAABBAACAAABBCABCCACABCCBBAACAB"
                                                                2⤵
                                                                  PID:4048
                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                    sc create "UserDataSvc_BACCCBBCBBCBCACBCACAAAABBAACAAABBCABCCACABCCBBAACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBCCAABBBABBBACBAAABABBCBBCCCCBCCCAABACBBBABCCACBCA.exe" start= auto displayName= "UserDataSvc_BACCCBBCBBCBCACBCACAAAABBAACAAABBCABCCACABCCBBAACAB"
                                                                    3⤵
                                                                    • Launches sc.exe
                                                                    PID:5608
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCCBBCBBCBCACBCACAAAABBAACAAABBCABCCACABCCBBAACAB"
                                                                  2⤵
                                                                    PID:4344
                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                      sc start "UserDataSvc_BACCCBBCBBCBCACBCACAAAABBAACAAABBCABCCACABCCBBAACAB"
                                                                      3⤵
                                                                      • Launches sc.exe
                                                                      PID:2440
                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAABBACBBCBBCCAABABAAAABCAACCCCBCBABABBBCCACCCBAAAC.exe
                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAABBACBBCBBCCAABABAAAABCAACCCCBCBABABBBCCACCCBAAAC.exe
                                                                  1⤵
                                                                    PID:1212
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBBCACCACCACCBBACBAABBCCBBBACBACCCAABBCAACBBCCABBCACBBACCCBBABACCCBCACCCACABBBBCACCAABBCAABAAABABCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAAABBAAABCBCBBCBBABABABACBBABABAACBCBABCCBABABBCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                      2⤵
                                                                        PID:2420
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBBCACCACCACCBBACBAABBCCBBBACBACCCAABBCAACBBCCABBCACBBACCCBBABACCCBCACCCACABBBBCACCAABBCAABAAABABCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAAABBAAABCBCBBCBBABABABACBBABABAACBCBABCCBABABBCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                          3⤵
                                                                          • Scheduled Task/Job: Scheduled Task
                                                                          PID:6056
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACABBBCCCBBBABCABBACABCBBABBBBCBBAACCCBCBAAAAAABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAAABBAAABCBCBBCBBABABABACBBABABAACBCBABCCBABABBCBCA.exe" start= auto displayName= "UserDataSvc_CACABBBCCCBBBABCABBACABCBBABBBBCBBAACCCBCBAAAAAABAA"
                                                                        2⤵
                                                                          PID:4596
                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                            sc create "UserDataSvc_CACABBBCCCBBBABCABBACABCBBABBBBCBBAACCCBCBAAAAAABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAAABBAAABCBCBBCBBABABABACBBABABAACBCBABCCBABABBCBCA.exe" start= auto displayName= "UserDataSvc_CACABBBCCCBBBABCABBACABCBBABBBBCBBAACCCBCBAAAAAABAA"
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:5448
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACABBBCCCBBBABCABBACABCBBABBBBCBBAACCCBCBAAAAAABAA"
                                                                          2⤵
                                                                            PID:4972
                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                              sc start "UserDataSvc_CACABBBCCCBBBABCABBACABCBBABBBBCBBAACCCBCBAAAAAABAA"
                                                                              3⤵
                                                                              • Launches sc.exe
                                                                              PID:2980
                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBCCAABBBABBBACBAAABABBCBBCCCCBCCCAABACBBBABCCACBCA.exe
                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBCCAABBBABBBACBAAABABBCBBCCCCBCCCAABACBBBABCCACBCA.exe
                                                                          1⤵
                                                                            PID:4900
                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAAABBAAABCBCBBCBBABABABACBBABABAACBCBABCCBABABBCBCA.exe
                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAAABBAAABCBCBBCBBABABABACBBABABAACBCBABCCBABABBCBCA.exe
                                                                            1⤵
                                                                              PID:4840

                                                                            Network

                                                                                  MITRE ATT&CK Enterprise v16

                                                                                  Reconnaissance

                                                                                  Resource Development

                                                                                  Initial Access

                                                                                  Execution

                                                                                  Scheduled Task/Job

                                                                                  1
                                                                                  T1053

                                                                                  Scheduled Task

                                                                                  1
                                                                                  T1053.005

                                                                                  System Services

                                                                                  1
                                                                                  T1569

                                                                                  Service Execution

                                                                                  1
                                                                                  T1569.002

                                                                                  Persistence

                                                                                  Boot or Logon Autostart Execution

                                                                                  2
                                                                                  T1547

                                                                                  Active Setup

                                                                                  1
                                                                                  T1547.014

                                                                                  Registry Run Keys / Startup Folder

                                                                                  1
                                                                                  T1547.001

                                                                                  Create or Modify System Process

                                                                                  1
                                                                                  T1543

                                                                                  Windows Service

                                                                                  1
                                                                                  T1543.003

                                                                                  Scheduled Task/Job

                                                                                  1
                                                                                  T1053

                                                                                  Scheduled Task

                                                                                  1
                                                                                  T1053.005

                                                                                  Privilege Escalation

                                                                                  Boot or Logon Autostart Execution

                                                                                  2
                                                                                  T1547

                                                                                  Active Setup

                                                                                  1
                                                                                  T1547.014

                                                                                  Registry Run Keys / Startup Folder

                                                                                  1
                                                                                  T1547.001

                                                                                  Create or Modify System Process

                                                                                  1
                                                                                  T1543

                                                                                  Windows Service

                                                                                  1
                                                                                  T1543.003

                                                                                  Scheduled Task/Job

                                                                                  1
                                                                                  T1053

                                                                                  Scheduled Task

                                                                                  1
                                                                                  T1053.005

                                                                                  Defense Evasion

                                                                                  Modify Registry

                                                                                  3
                                                                                  T1112

                                                                                  Credential Access

                                                                                  Discovery

                                                                                  Peripheral Device Discovery

                                                                                  2
                                                                                  T1120

                                                                                  Query Registry

                                                                                  3
                                                                                  T1012

                                                                                  System Information Discovery

                                                                                  2
                                                                                  T1082

                                                                                  System Location Discovery

                                                                                  1
                                                                                  T1614

                                                                                  System Language Discovery

                                                                                  1
                                                                                  T1614.001

                                                                                  Lateral Movement

                                                                                  Collection

                                                                                  Command and Control

                                                                                  Exfiltration

                                                                                  Impact

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  prep_Activatable Class_Hermes_perf.cache
                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                  • Size 599B
                                                                                  • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  qap`g`v~dtlq
                                                                                  • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
                                                                                  • Size 10B
                                                                                  • SHA256 d83ab7ef1a41737ab6a2c363f422e24548c923da67133ca5b54b40a14511553f
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  qap`g`v~dtlq
                                                                                  • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
                                                                                  • Size 10B
                                                                                  • SHA256 bdab8baf1583fa64dcbba96674687733918181c7de01545987b3515f0e1ba105
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  qap`g`v~dtlq
                                                                                  • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
                                                                                  • Size 10B
                                                                                  • SHA256 b66a1ad2cc04a2471311cbcbb44619158e9250be0eae0454e46075ef0fc0fb59
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  qap`g`v~dtlq
                                                                                  • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
                                                                                  • Size 10B
                                                                                  • SHA256 4607380606744d3ea29697d527d87f94760622ca9d19e26c503383ec789e33c1
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  qap`g`v~dtlq
                                                                                  • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
                                                                                  • Size 10B
                                                                                  • SHA256 985d54a77c25ed170535c9c9a89fdd5544d0e1076688fab6b5915d626eaf8a3e
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  qap`g`v~dtlq
                                                                                  • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
                                                                                  • Size 10B
                                                                                  • SHA256 9c041c454bf367b3798ddc3b63030f70bec62e8f06a9a273ea5a68147b3f8824
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  svchost_AAAAABACABCACABBBABABBAABABACBAACCCCACBCABABBACBCACBCCA.exe
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABACABCACABBBABABBAABABACBAACCCCACBCABABBACBCACBCCA.exe
                                                                                  • Size 2.6MB
                                                                                  • SHA256 799ca87d2d265e95114b6aa4da95192e07eec2da71d5d133704b6cfc541446ec
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 1KB
                                                                                  • SHA256 5c01cae3495e5ef18dd56dcb0bbc104ec03a3ba79ed19a32181cfe4ff3e29115
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 1KB
                                                                                  • SHA256 c79b4b445d22c968a3e80c0ac5d884433a7ce03678ab594c80bf86ffd73c3d54
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 1KB
                                                                                  • SHA256 f4ba3a72facf1759111154995a93ba4be557302fec0773ba667a3b5aa8d296bd
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 2KB
                                                                                  • SHA256 034e63421ccc6c96ab7f5c3a612d3e814b561b2f954112f61d09379ac1856f30
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 2KB
                                                                                  • SHA256 583d731ebf09a7cc92a25f84e85ffbb7a088298594df445e1244757dffbbc676
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 2KB
                                                                                  • SHA256 f724baa9205fd74b775633577a0e0e601cfecb3115d43b6f913aab857e81bcc1
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 3KB
                                                                                  • SHA256 8eddc2b04f67e668bcfa3c21f698599dd81e4bd2c927e69d99e354247fc15917
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 4KB
                                                                                  • SHA256 7a35168cda5757b653887c3f34e17ce0b31cfaab46853594448aac3a6390783c
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 4KB
                                                                                  • SHA256 62af2b510dd3f8ab77f3347c0292a0a851dcef76eaab71ffa0e344ca505a0611
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 6KB
                                                                                  • SHA256 fc768bc39e956e12d7fcf24dc3169c8723e5a0355849baaf551eefbd95f93773
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 7KB
                                                                                  • SHA256 40bb4d74505434c28b40c9f4d2069ac4dee8c4805d1aab6a4fa05c19722e8a95
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 8KB
                                                                                  • SHA256 2a293f5835244ae48d48cd0c7de3147aa4c152b4986c8698b6f073ca2eb0e57a
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 8KB
                                                                                  • SHA256 01d7f9c6f92df2e5c8b48774bdf6d6781e5b6daa07004c7f2069c53d2153f93b
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 10KB
                                                                                  • SHA256 d37873178052efaf487ceba4951b5ee351f39e308b8373f7e858fd24f47c3daa
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 11KB
                                                                                  • SHA256 f6171bf53b284fddd3d200a2568d8c920a315bfc1f54f9b2bf130a1aca591718
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 12KB
                                                                                  • SHA256 d0ccdd83cc01ded0246a7334b61af6c3cb673b35f8b72e7f92eaafd1a07fe389
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 13KB
                                                                                  • SHA256 9ce308c7e711d5295878c66e44a6e6940ca5c59bbd3a1c8e6acb8bc917d34d87
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 14KB
                                                                                  • SHA256 bed3dd87b9ce1d9e2f840f03179c2c8dca33f97d55cba499f7071f4695b41932
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 15KB
                                                                                  • SHA256 de1bfb018d252df19e2ff265e0b8dce00aefd616799d9762b1f9293cbcb431a8
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 16KB
                                                                                  • SHA256 0b2c4e679384ea704ece3b172a0cce84b9dcbaadd53d67d9b9f41e1a88e4b7b0
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 17KB
                                                                                  • SHA256 b5cfee9cca26e46cccf23e597e2d8cd46974a6354f60d89b8e96fe8003e091d0
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 18KB
                                                                                  • SHA256 af7568a5e2b7aa39886fbae0f904ca2a5ced5a120cbeea4ef0477b942f226bb8
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 19KB
                                                                                  • SHA256 df65d6918471066b772db0522e5252a975b8d57a57cebc689ba05d2f43c1d533
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 19KB
                                                                                  • SHA256 f4fd06dd0f731e1e59a148d77393abd7353d07190e059b435e4820b25a980a3f
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  virus_log.txt
                                                                                  • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                  • Size 21KB
                                                                                  • SHA256 155dd3d1e6126626bb243e1ec274a9d923980caf2b645d3e0bd99ee0587a9282
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  memory/1212-546-0x0000000000BA0000-0x0000000000BC2000-memory.dmp
                                                                                  Download

                                                                                  memory/1932-228-0x0000000000FC0000-0x0000000000FE2000-memory.dmp
                                                                                  Download

                                                                                  memory/1932-139-0x0000000000FC0000-0x0000000000FE2000-memory.dmp
                                                                                  Download

                                                                                  memory/2388-531-0x0000000000E70000-0x0000000000E92000-memory.dmp
                                                                                  Download

                                                                                  memory/2388-550-0x0000000000E70000-0x0000000000E92000-memory.dmp
                                                                                  Download

                                                                                  memory/2584-310-0x0000000000500000-0x0000000000522000-memory.dmp
                                                                                  Download

                                                                                  memory/2584-375-0x0000000000500000-0x0000000000522000-memory.dmp
                                                                                  Download

                                                                                  memory/2984-500-0x0000000000FE0000-0x0000000001002000-memory.dmp
                                                                                  Download

                                                                                  memory/3328-485-0x0000000000A80000-0x0000000000AA2000-memory.dmp
                                                                                  Download

                                                                                  memory/3372-258-0x0000000000740000-0x0000000000762000-memory.dmp
                                                                                  Download

                                                                                  memory/3380-306-0x0000000000560000-0x0000000000582000-memory.dmp
                                                                                  Download

                                                                                  memory/3768-304-0x0000000000120000-0x0000000000142000-memory.dmp
                                                                                  Download

                                                                                  memory/3780-257-0x0000000000ED0000-0x0000000000EF2000-memory.dmp
                                                                                  Download

                                                                                  memory/3960-518-0x0000000000430000-0x0000000000452000-memory.dmp
                                                                                  Download

                                                                                  memory/4012-448-0x0000000000EE0000-0x0000000000F02000-memory.dmp
                                                                                  Download

                                                                                  memory/4012-487-0x0000000000EE0000-0x0000000000F02000-memory.dmp
                                                                                  Download

                                                                                  memory/4868-429-0x0000000000D10000-0x0000000000D32000-memory.dmp
                                                                                  Download

                                                                                  memory/4900-560-0x0000000000D10000-0x0000000000D32000-memory.dmp
                                                                                  Download

                                                                                  memory/5044-431-0x0000000000550000-0x0000000000572000-memory.dmp
                                                                                  Download

                                                                                  memory/5044-393-0x0000000000550000-0x0000000000572000-memory.dmp
                                                                                  Download

                                                                                  memory/5240-230-0x0000000000FC0000-0x0000000000FE2000-memory.dmp
                                                                                  Download

                                                                                  memory/5240-140-0x0000000000FC0000-0x0000000000FE2000-memory.dmp
                                                                                  Download

                                                                                  memory/5552-376-0x0000000000970000-0x0000000000992000-memory.dmp
                                                                                  Download

                                                                                  memory/5552-311-0x0000000000970000-0x0000000000992000-memory.dmp
                                                                                  Download

                                                                                  memory/5820-447-0x00000000004C0000-0x00000000004E2000-memory.dmp
                                                                                  Download

                                                                                  memory/5964-0-0x0000000000D70000-0x0000000000D92000-memory.dmp
                                                                                  Download

                                                                                  memory/5964-12-0x0000000000D70000-0x0000000000D92000-memory.dmp
                                                                                  Download

                                                                                  memory/5996-420-0x00000000005B0000-0x00000000005D2000-memory.dmp
                                                                                  Download

                                                                                  memory/5996-378-0x00000000005B0000-0x00000000005D2000-memory.dmp
                                                                                  Download

                                                                                  memory/6052-52-0x000001E003A10000-0x000001E003A30000-memory.dmp
                                                                                  Download

                                                                                  memory/6052-53-0x000001E013EE0000-0x000001E013FE0000-memory.dmp
                                                                                  Download

                                                                                  memory/6052-79-0x000001E0142F0000-0x000001E014310000-memory.dmp
                                                                                  Download

                                                                                  memory/6052-65-0x000001E003D10000-0x000001E003D30000-memory.dmp
                                                                                  Download

                                                                                  memory/6052-33-0x000001E0001E0000-0x000001E0002E0000-memory.dmp
                                                                                  Download