Overview

overview

7

Static

static

3

2026-07-04...er.exe

windows10-2004-x64

7

2026-07-04...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260630-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 00:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-04_ae03b795f9b9f92e03ec7b28c87594c2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
  • Size 2.6MB
  • Sample260705-appzaafw3x
  • SHA256 1d99b417e05221313f6859a7ede3b247393d0a391e25eceb72a9381ecc134409
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Drops startup file 9 IoCs
  • Executes dropped EXE 47 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 9 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Launches sc.exe 64 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 40 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-04_ae03b795f9b9f92e03ec7b28c87594c2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-04_ae03b795f9b9f92e03ec7b28c87594c2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5792
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBBACACBCCACCBACACBABBAABCCACCBACAACABACABCBCBCAAABCABCBCBCCACBBBCCACCCBAAAACBBACAAAACACBCCCCCBCCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCCCBCCABBACBACAABBBCCABAAACBAABAABBBAABABBAACAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3540
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBBACACBCCACCBACACBABBAABCCACCBACAACABACABCBCBCAAABCABCBCBCCACBBBCCACCCBAAAACBBACAAAACACBCCCCCBCCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCCCBCCABBACBACAABBBCCABAAACBAABAABBBAABABBAACAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4460
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCACBBCAACCCBCBBABCBCCAACCCACAAAAACCCBABBCACAAACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCCCBCCABBACBACAABBBCCABAAACBAABAABBBAABABBAACAAAAB.exe" start= auto displayName= "UserDataSvc_CCCACBBCAACCCBCBBABCBCCAACCCACAAAAACCCBABBCACAAACCA"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5136
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_CCCACBBCAACCCBCBBABCBCCAACCCACAAAAACCCBABBCACAAACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCCCBCCABBACBACAABBBCCABAAACBAABAABBBAABABBAACAAAAB.exe" start= auto displayName= "UserDataSvc_CCCACBBCAACCCBCBBABCBCCAACCCACAAAAACCCBABBCACAAACCA"
        3⤵
          PID:3296
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCACBBCAACCCBCBBABCBCCAACCCACAAAAACCCBABBCACAAACCA"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1672
        • C:\Windows\SysWOW64\sc.exe
          sc start "UserDataSvc_CCCACBBCAACCCBCBBABCBCCAACCCACAAAAACCCBABBCACAAACCA"
          3⤵
            PID:2776
      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCCCBCCABBACBACAABBBCCABAAACBAABAABBBAABABBAACAAAAB.exe
        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCCCBCCABBACBACAABBBCCABAAACBAABAABBBAABABBAACAAAAB.exe
        1⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:6092
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCCBBAABCBABCABACBABBABBBBCACBBBBBBBCBABACCBAAACBBCCBCCBCACBCBCAACACBCABCCCBCABAAACCBCACACAABABBABABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBBAABCBABCABACBABBABBBBCACBBBBBBBCBABACCBAAACBBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3604
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCCBBAABCBABCABACBABBABBBBCACBBBBBBBCBABACCBAAACBBCCBCCBCACBCBCAACACBCABCCCBCABAAACCBCACACAABABBABABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBBAABCBABCABACBABBABBBBCACBBBBBBBCBABACCBAAACBBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:1876
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBAAACCACABCAAAABACBCACABBCBBBAACBCCCACCABABCBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBBAABCBABCABACBABBABBBBCACBBBBBBBCBABACCBAAACBBCCB.exe" start= auto displayName= "UserDataSvc_BCCBAAACCACABCAAAABACBCACABBCBBBAACBCCCACCABABCBABA"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6588
          • C:\Windows\SysWOW64\sc.exe
            sc create "UserDataSvc_BCCBAAACCACABCAAAABACBCACABBCBBBAACBCCCACCABABCBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBBAABCBABCABACBABBABBBBCACBBBBBBBCBABACCBAAACBBCCB.exe" start= auto displayName= "UserDataSvc_BCCBAAACCACABCAAAABACBCACABBCBBBAACBCCCACCABABCBABA"
            3⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:2096
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBAAACCACABCAAAABACBCACABBCBBBAACBCCCACCABABCBABA"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2036
          • C:\Windows\SysWOW64\sc.exe
            sc start "UserDataSvc_BCCBAAACCACABCAAAABACBCACABBCBBBAACBCCCACCABABCBABA"
            3⤵
            • Launches sc.exe
            PID:1452
      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCCCBCCABBACBACAABBBCCABAAACBAABAABBBAABABBAACAAAAB.exe
        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCCCBCCABBACBACAABBBCCABAAACBAABAABBBAABABBAACAAAAB.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:424
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCBAAABABAACCCBAAAAAACBACAAABBCACCBABACBAACCCBACAAACBAACCAAACBBACBABABCBCABCBBAAAABBAABCBBCCABBACACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBCCBCACCBAACBACCBBBACABCCAACCCCCBBBCABAAABCCABBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3320
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCBAAABABAACCCBAAAAAACBACAAABBCACCBABACBAACCCBACAAACBAACCAAACBBACBABABCBCABCBBAAAABBAABCBBCCABBACACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBCCBCACCBAACBACCBBBACABCCAACCCCCBBBCABAAABCCABBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:6320
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCABCCBCCABABBAABABABCCACBBBACBBBCBACCCBCCABBBBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBCCBCACCBAACBACCBBBACABCCAACCCCCBBBCABAAABCCABBCB.exe" start= auto displayName= "UserDataSvc_ACCABCCBCCABABBAABABABCCACBBBACBBBCBACCCBCCABBBBCCA"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4568
          • C:\Windows\SysWOW64\sc.exe
            sc create "UserDataSvc_ACCABCCBCCABABBAABABABCCACBBBACBBBCBACCCBCCABBBBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBCCBCACCBAACBACCBBBACABCCAACCCCCBBBCABAAABCCABBCB.exe" start= auto displayName= "UserDataSvc_ACCABCCBCCABABBAABABABCCACBBBACBBBCBACCCBCCABBBBCCA"
            3⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:2188
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCABCCBCCABABBAABABABCCACBBBACBBBCBACCCBCCABBBBCCA"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:592
          • C:\Windows\SysWOW64\sc.exe
            sc start "UserDataSvc_ACCABCCBCCABABBAABABABCCACBBBACBBBCBACCCBCCABBBBCCA"
            3⤵
            • Launches sc.exe
            PID:1952
      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBBAABCBABCABACBABBABBBBCACBBBBBBBCBABACCBAAACBBCCB.exe
        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBBAABCBABCABACBABBABBBBCACBBBBBBBCBABACCBAAACBBCCB.exe
        1⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4620
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABBCACAACABACCBCCBCCCCCCBCCCBAACCCAACCACAAAACBBBACCACACCACABABBBAAABCBCAACBCACCCCACCAAAAABCCAACBBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBCACAACABACCBCCBCCCCCCBCCCBAACCCAACCACAAAACBBBACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2224
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABBCACAACABACCBCCBCCCCCCBCCCBAACCCAACCACAAAACBBBACCACACCACABABBBAAABCBCAACBCACCCCACCAAAAABCCAACBBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBCACAACABACCBCCBCCCCCCBCCCBAACCCAACCACAAAACBBBACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
            3⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:2432
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBBCBCBCACBBABCBACACABBCCAAABCCABCBCBACBAABCBBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBCACAACABACCBCCBCCCCCCBCCCBAACCCAACCACAAAACBBBACCA.exe" start= auto displayName= "UserDataSvc_CBCBBCBCBCACBBABCBACACABBCCAAABCCABCBCBACBAABCBBAAA"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:6572
          • C:\Windows\SysWOW64\sc.exe
            sc create "UserDataSvc_CBCBBCBCBCACBBABCBACACABBCCAAABCCABCBCBACBAABCBBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBCACAACABACCBCCBCCCCCCBCCCBAACCCAACCACAAAACBBBACCA.exe" start= auto displayName= "UserDataSvc_CBCBBCBCBCACBBABCBACACABBCCAAABCCABCBCBACBAABCBBAAA"
            3⤵
            • Launches sc.exe
            PID:4616
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBBCBCBCACBBABCBACACABBCCAAABCCABCBCBACBAABCBBAAA"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:6036
          • C:\Windows\SysWOW64\sc.exe
            sc start "UserDataSvc_CBCBBCBCBCACBBABCBACACABBCCAAABCCABCBCBACBAABCBBAAA"
            3⤵
            • Launches sc.exe
            PID:6640
      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBBAABCBABCABACBABBABBBBCACBBBBBBBCBABACCBAAACBBCCB.exe
        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBBAABCBABCABACBABBABBBBCACBBBBBBBCBABACCBAAACBBCCB.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4596
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCCCCCCABBAACCBAACBABBBAACACAABAAABABACABCABCCBCCCCCBABCACBAABAABAACBCACCBACCCACCACACAABBAACACBACCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCBBBACACAACCBBAAAABABBACBACBABAAACACABAABABCCABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5920
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCCCCCCABBAACCBAACBABBBAACACAABAAABABACABCABCCBCCCCCBABCACBAABAABAACBCACCBACCCACCACACAABBAACACBACCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCBBBACACAACCBBAAAABABBACBACBABAAACACABAABABCCABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5324
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCABCCBACABCACBBCCCCAAABCCABBBCABBCABACCCCBCACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCBBBACACAACCBBAAAABABBACBACBABAAACACABAABABCCABBAA.exe" start= auto displayName= "UserDataSvc_ACBCABCCBACABCACBBCCCCAAABCCABBBCABBCABACCCCBCACBAA"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5784
          • C:\Windows\SysWOW64\sc.exe
            sc create "UserDataSvc_ACBCABCCBACABCACBBCCCCAAABCCABBBCABBCABACCCCBCACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCBBBACACAACCBBAAAABABBACBACBABAAACACABAABABCCABBAA.exe" start= auto displayName= "UserDataSvc_ACBCABCCBACABCACBBCCCCAAABCCABBBCABBCABACCCCBCACBAA"
            3⤵
            • Launches sc.exe
            PID:3256
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCABCCBACABCACBBCCCCAAABCCABBBCABBCABACCCCBCACBAA"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1784
          • C:\Windows\SysWOW64\sc.exe
            sc start "UserDataSvc_ACBCABCCBACABCACBBCCCCAAABCCABBBCABBCABACCCCBCACBAA"
            3⤵
              PID:3028
        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBCCBCACCBAACBACCBBBACABCCAACCCCCBBBCABAAABCCABBCB.exe
          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBCCBCACCBAACBACCBBBACABCCAACCCCCBBBCABAAABCCABBCB.exe
          1⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:6080
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABCACCCCABCCBCAAABCBBBBCBACAABABACCBBACABBCCCCBCAABCCACCCABAAACABACABCABCBCBAACCCBCAACBBBBABABCAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACCAAACAABBCACABCACBBACBBBCCBCCBAACACACCACCBBCBBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:6392
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABCACCCCABCCBCAAABCBBBBCBACAABABACCBBACABBCCCCBCAABCCACCCABAAACABACABCABCBCBAACCCBCAACBBBBABABCAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACCAAACAABBCACABCACBBACBBBCCBCCBAACACACCACCBBCBBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:4304
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBBBABBAAABABAACCAABBAAACCCBAABACAACCCABAACBABABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACCAAACAABBCACABCACBBACBBBCCBCCBAACACACCACCBBCBBACC.exe" start= auto displayName= "UserDataSvc_ACBBBABBAAABABAACCAABBAAACCCBAABACAACCCABAACBABABBB"
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5212
            • C:\Windows\SysWOW64\sc.exe
              sc create "UserDataSvc_ACBBBABBAAABABAACCAABBAAACCCBAABACAACCCABAACBABABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACCAAACAABBCACABCACBBACBBBCCBCCBAACACACCACCBBCBBACC.exe" start= auto displayName= "UserDataSvc_ACBBBABBAAABABAACCAABBAAACCCBAABACAACCCABAACBABABBB"
              3⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:2712
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBBBABBAAABABAACCAABBAAACCCBAABACAACCCABAACBABABBB"
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2652
            • C:\Windows\SysWOW64\sc.exe
              sc start "UserDataSvc_ACBBBABBAAABABAACCAABBAAACCCBAABACAACCCABAACBABABBB"
              3⤵
              • Launches sc.exe
              PID:5104
        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBCCBCACCBAACBACCBBBACABCCAACCCCCBBBCABAAABCCABBCB.exe
          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBBCCBCACCBAACBACCBBBACABCCAACCCCCBBBCABAAABCCABBCB.exe
          1⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:6952
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABCACCCCABCCBCAAABCBBBBCBACAABABACCBBACABBCCCCBCAABCCACCCABAAACABACABCABCBCBAACCCBCAACBBBBABABCAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACCAAACAABBCACABCACBBACBBBCCBCCBAACACACCACCBBCBBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:7148
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABCACCCCABCCBCAAABCBBBBCBACAABABACCBBACABBCCCCBCAABCCACCCABAAACABACABCABCBCBAACCCBCAACBBBBABABCAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACCAAACAABBCACABCACBBACBBBCCBCCBAACACACCACCBBCBBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:3824
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABBBACACCBAACBCCACCCABCBBCCCABCACCCACABACCACCABCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACCAAACAABBCACABCACBBACBBBCCBCCBAACACACCACCBBCBBACC.exe" start= auto displayName= "UserDataSvc_BABBBACACCBAACBCCACCCABCBBCCCABCACCCACABACCACCABCCB"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2512
            • C:\Windows\SysWOW64\sc.exe
              sc create "UserDataSvc_BABBBACACCBAACBCCACCCABCBBCCCABCACCCACABACCACCABCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACCAAACAABBCACABCACBBACBBBCCBCCBAACACACCACCBBCBBACC.exe" start= auto displayName= "UserDataSvc_BABBBACACCBAACBCCACCCABCBBCCCABCACCCACABACCACCABCCB"
              3⤵
              • Launches sc.exe
              PID:5144
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABBBACACCBAACBCCACCCABCBBCCCABCACCCACABACCACCABCCB"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:6232
            • C:\Windows\SysWOW64\sc.exe
              sc start "UserDataSvc_BABBBACACCBAACBCCACCCABCBBCCCABCACCCACABACCACCABCCB"
              3⤵
              • Launches sc.exe
              PID:3260
        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACCAAACAABBCACABCACBBACBBBCCBCCBAACACACCACCBBCBBACC.exe
          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACCAAACAABBCACABCACBBACBBBCCBCCBAACACACCACCBBCBBACC.exe
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:6484
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBAACAABABBAAACBABABABBCACCAACCBBBACCCBCAABACBCABBCACBCCAAABAAABBCBCAABACBCBBBACCCACAAABCCABBCABCBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAACAABABBAAACBABABABBCACCAACCBBBACCCBCAABACBCABBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2468
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBAACAABABBAAACBABABABBCACCAACCBBBACCCBCAABACBCABBCACBCCAAABAAABBCBCAABACBCBBBACCCACAAABCCABBCABCBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAACAABABBAAACBABABABBCACCAACCBBBACCCBCAABACBCABBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2920
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCCBAAACCACACCAAABAACACBCABCBCCABCACAABBBABAACAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAACAABABBAAACBABABABBCACCAACCBBBACCCBCAABACBCABBCAC.exe" start= auto displayName= "UserDataSvc_CBBCCBAAACCACACCAAABAACACBCABCBCCABCACAABBBABAACAAB"
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3732
            • C:\Windows\SysWOW64\sc.exe
              sc create "UserDataSvc_CBBCCBAAACCACACCAAABAACACBCABCBCCABCACAABBBABAACAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAACAABABBAAACBABABABBCACCAACCBBBACCCBCAABACBCABBCAC.exe" start= auto displayName= "UserDataSvc_CBBCCBAAACCACACCAAABAACACBCABCBCCABCACAABBBABAACAAB"
              3⤵
              • Launches sc.exe
              PID:1168
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCCBAAACCACACCAAABAACACBCABCBCCABCACAABBBABAACAAB"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:6692
            • C:\Windows\SysWOW64\sc.exe
              sc start "UserDataSvc_CBBCCBAAACCACACCAAABAACACBCABCBCCABCACAABBBABAACAAB"
              3⤵
              • Launches sc.exe
              PID:6584
        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACCAAACAABBCACABCACBBACBBBCCBCCBAACACACCACCBBCBBACC.exe
          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACCAAACAABBCACABCACBBACBBBCCBCCBAACACACCACCBBCBBACC.exe
          1⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2500
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAACBAACAAABAACCCCCACCCABAAABBAACCBCCACAAAACACACCBCACCACCBACABACBAAACCCBCCCAABCCAACCCAACCBBCCBABABAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACBAACAAABAACCCCCACCCABAAABBAACCBCCACAAAACACACCBCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2276
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAACBAACAAABAACCCCCACCCABAAABBAACCBCCACAAAACACACCBCACCACCBACABACBAAACCCBCCCAABCCAACCCAACCBBCCBABABAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACBAACAAABAACCCCCACCCABAAABBAACCBCCACAAAACACACCBCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:3812
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCCBACCCCAACCCCCABABABCACBACABCABCCCAABCCAAABBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACBAACAAABAACCCCCACCCABAAABBAACCBCCACAAAACACACCBCACC.exe" start= auto displayName= "UserDataSvc_AABCCBACCCCAACCCCCABABABCACBACABCABCCCAABCCAAABBCAC"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1148
            • C:\Windows\SysWOW64\sc.exe
              sc create "UserDataSvc_AABCCBACCCCAACCCCCABABABCACBACABCABCCCAABCCAAABBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACBAACAAABAACCCCCACCCABAAABBAACCBCCACAAAACACACCBCACC.exe" start= auto displayName= "UserDataSvc_AABCCBACCCCAACCCCCABABABCACBACABCABCCCAABCCAAABBCAC"
              3⤵
              • Launches sc.exe
              PID:3952
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCCBACCCCAACCCCCABABABCACBACABCABCCCAABCCAAABBCAC"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3144
            • C:\Windows\SysWOW64\sc.exe
              sc start "UserDataSvc_AABCCBACCCCAACCCCCABABABCACBACABCABCCCAABCCAAABBCAC"
              3⤵
              • Launches sc.exe
              PID:6968
        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAACAABABBAAACBABABABBCACCAACCBBBACCCBCAABACBCABBCAC.exe
          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAACAABABBAAACBABABABBCACCAACCBBBACCCBCAABACBCABBCAC.exe
          1⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:6880
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBAACCAAACBAABCCCCABBCAABAAAABCCBABABCCBBCCABBAABBCBACABBCCBBCBAABCBCACCBBACCCABACCABBAABCCBACCAACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABCCBBABAAABAAABCABACAAABAABCCCCCAABACBCBCAABABAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4600
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBAACCAAACBAABCCCCABBCAABAAAABCCBABABCCBBCCABBAABBCBACABBCCBBCBAABCBCACCBBACCCABACCABBAABCCBACCAACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABCCBBABAAABAAABCABACAAABAABCCCCCAABACBCBCAABABAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:6172
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCCAACCCBAAACCCCBBCACBBBCCCBBCAABBCBAABABCCCAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABCCBBABAAABAAABCABACAAABAABCCCCCAABACBCBCAABABAABCB.exe" start= auto displayName= "UserDataSvc_ACBCCAACCCBAAACCCCBBCACBBBCCCBBCAABBCBAABABCCCAABBA"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:6096
            • C:\Windows\SysWOW64\sc.exe
              sc create "UserDataSvc_ACBCCAACCCBAAACCCCBBCACBBBCCCBBCAABBCBAABABCCCAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABCCBBABAAABAAABCABACAAABAABCCCCCAABACBCBCAABABAABCB.exe" start= auto displayName= "UserDataSvc_ACBCCAACCCBAAACCCCBBCACBBBCCCBBCAABBCBAABABCCCAABBA"
              3⤵
              • Launches sc.exe
              PID:5904
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCCAACCCBAAACCCCBBCACBBBCCCBBCAABBCBAABABCCCAABBA"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:700
            • C:\Windows\SysWOW64\sc.exe
              sc start "UserDataSvc_ACBCCAACCCBAAACCCCBBCACBBBCCCBBCAABBCBAABABCCCAABBA"
              3⤵
              • Launches sc.exe
              PID:4244
        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACBAACAAABAACCCCCACCCABAAABBAACCBCCACAAAACACACCBCACC.exe
          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACBAACAAABAACCCCCACCCABAAABBAACCBCCACAAAACACACCBCACC.exe
          1⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4944
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBBBCCACACBBBBBBABCCBABCBBBABCBBCCBCABBCABCCCABCAAABCCCBABCBABBBCBCCACABABBBCABABCCAACBBCACAAACBBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBCABACABBCCBCCCCBABCBCBACAABCBBAACBCACCBBACABAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3316
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBBBCCACACBBBBBBABCCBABCBBBABCBBCCBCABBCABCCCABCAAABCCCBABCBABBBCBCCACABABBBCABABCCAACBBCACAAACBBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBCABACABBCCBCCCCBABCBCBACAABCBBAACBCACCBBACABAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2708
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCACAACCBACABCACBAACCBBAABBACBCCABCACBAACAAAABCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBCABACABBCCBCCCCBABCBCBACAABCBBAACBCACCBBACABAAACB.exe" start= auto displayName= "UserDataSvc_BCBCACAACCBACABCACBAACCBBAABBACBCCABCACBAACAAAABCAC"
            2⤵
              PID:7044
              • C:\Windows\SysWOW64\sc.exe
                sc create "UserDataSvc_BCBCACAACCBACABCACBAACCBBAABBACBCCABCACBAACAAAABCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBCABACABBCCBCCCCBABCBCBACAABCBBAACBCACCBBACABAAACB.exe" start= auto displayName= "UserDataSvc_BCBCACAACCBACABCACBAACCBBAABBACBCCABCACBAACAAAABCAC"
                3⤵
                • Launches sc.exe
                PID:2780
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCACAACCBACABCACBAACCBBAABBACBCCABCACBAACAAAABCAC"
              2⤵
                PID:5512
                • C:\Windows\SysWOW64\sc.exe
                  sc start "UserDataSvc_BCBCACAACCBACABCACBAACCBBAABBACBCCABCACBAACAAAABCAC"
                  3⤵
                    PID:5504
              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACBAACAAABAACCCCCACCCABAAABBAACCBCCACAAAACACACCBCACC.exe
                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACBAACAAABAACCCCCACCCABAAABBAACCBCCACAAAACACACCBCACC.exe
                1⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:6820
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACCBABBACACABCABBBCCBAABCABCCBAAACACBCBCBBBBABCAACCCABABBBACAAABABCCABBACBBBBCAABCABBCAABCBBAACBCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCBABBACACABCABBBCCBAABCABCCBAAACACBCBCBBBBABCAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                  2⤵
                    PID:1640
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACCBABBACACABCABBBCCBAABCABCCBAAACACBCBCBBBBABCAACCCABABBBACAAABABCCABBACBBBBCAABCABBCAABCBBAACBCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCBABBACACABCABBBCCBAABCABCCBAAACACBCBCBBBBABCAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Scheduled Task/Job: Scheduled Task
                      PID:4992
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABBABCCACBAACBACBBBBACBCCCABCCAABBAAACACBCAABBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCBABBACACABCABBBCCBAABCABCCBAAACACBCBCBBBBABCAACCC.exe" start= auto displayName= "UserDataSvc_AAABBABCCACBAACBACBBBBACBCCCABCCAABBAAACACBCAABBACA"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:2912
                    • C:\Windows\SysWOW64\sc.exe
                      sc create "UserDataSvc_AAABBABCCACBAACBACBBBBACBCCCABCCAABBAAACACBCAABBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCBABBACACABCABBBCCBAABCABCCBAAACACBCBCBBBBABCAACCC.exe" start= auto displayName= "UserDataSvc_AAABBABCCACBAACBACBBBBACBCCCABCCAABBAAACACBCAABBACA"
                      3⤵
                      • Launches sc.exe
                      PID:5892
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABBABCCACBAACBACBBBBACBCCCABCCAABBAAACACBCAABBACA"
                    2⤵
                      PID:5528
                      • C:\Windows\SysWOW64\sc.exe
                        sc start "UserDataSvc_AAABBABCCACBAACBACBBBBACBCCCABCCAABBAAACACBCAABBACA"
                        3⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:4476
                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBCACAACABACCBCCBCCCCCCBCCCBAACCCAACCACAAAACBBBACCA.exe
                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBCACAACABACCBCCBCCCCCCBCCCBAACCCAACCACAAAACBBBACCA.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3212
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAACCBACCABAABABCBBABCBAABAABCCAAABCAAAABCCBCABBBBBCACCAACBBBBCCCACCBAACCBCABAABABCBBABCACAABCCBCCCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCBACCABAABABCBBABCBAABAABCCAAABCAAAABCCBCABBBBBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                      2⤵
                        PID:4172
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAACCBACCABAABABCBBABCBAABAABCCAAABCAAAABCCBCABBBBBCACCAACBBBBCCCACCBAACCBCABAABABCBBABCACAABCCBCCCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCBACCABAABABCBBABCBAABAABCCAAABCAAAABCCBCABBBBBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                          3⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:4892
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCABCCABAAABAABAACBAACABCAAAAAAAABCCACACACBBCBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCBACCABAABABCBBABCBAABAABCCAAABCAAAABCCBCABBBBBCAC.exe" start= auto displayName= "UserDataSvc_ACBCABCCABAAABAABAACBAACABCAAAAAAAABCCACACACBBCBACA"
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:6200
                        • C:\Windows\SysWOW64\sc.exe
                          sc create "UserDataSvc_ACBCABCCABAAABAABAACBAACABCAAAAAAAABCCACACACBBCBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCBACCABAABABCBBABCBAABAABCCAAABCAAAABCCBCABBBBBCAC.exe" start= auto displayName= "UserDataSvc_ACBCABCCABAAABAABAACBAACABCAAAAAAAABCCACACACBBCBACA"
                          3⤵
                          • Launches sc.exe
                          PID:2424
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCABCCABAAABAABAACBAACABCAAAAAAAABCCACACACBBCBACA"
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:3716
                        • C:\Windows\SysWOW64\sc.exe
                          sc start "UserDataSvc_ACBCABCCABAAABAABAACBAACABCAAAAAAAABCCACACACBBCBACA"
                          3⤵
                          • Launches sc.exe
                          PID:6804
                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCBBBACACAACCBBAAAABABBACBACBABAAACACABAABABCCABBAA.exe
                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCBBBACACAACCBBAAAABABBACBACBABAAACACABAABABCCABBAA.exe
                      1⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5304
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABCBCCCCACAAACCBCCCACACCBCBAACABACBAACACABBBBBCAABABCAACCCCBACACABACBCCABAACCACBCCCCCBBAAAAACBCBAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBAABBBABBBBCABABBCCABABAACBABAACBBAAAAAAACACBBCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                        2⤵
                          PID:6896
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABCBCCCCACAAACCBCCCACACCBCBAACABACBAACACABBBBBCAABABCAACCCCBACACABACBCCABAACCACBCCCCCBBAAAAACBCBAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBAABBBABBBBCABABBCCABABAACBABAACBBAAAAAAACACBBCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Scheduled Task/Job: Scheduled Task
                            PID:1952
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABACBACACAACBBBABAAABABBBCACACCACAAAABBBABCAACCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBAABBBABBBBCABABBCCABABAACBABAACBBAAAAAAACACBBCAAC.exe" start= auto displayName= "UserDataSvc_BABACBACACAACBBBABAAABABBBCACACCACAAAABBBABCAACCCCB"
                          2⤵
                            PID:2448
                            • C:\Windows\SysWOW64\sc.exe
                              sc create "UserDataSvc_BABACBACACAACBBBABAAABABBBCACACCACAAAABBBABCAACCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBAABBBABBBBCABABBCCABABAACBABAACBBAAAAAAACACBBCAAC.exe" start= auto displayName= "UserDataSvc_BABACBACACAACBBBABAAABABBBCACACCACAAAABBBABCAACCCCB"
                              3⤵
                              • Launches sc.exe
                              PID:6520
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABACBACACAACBBBABAAABABBBCACACCACAAAABBBABCAACCCCB"
                            2⤵
                              PID:1984
                              • C:\Windows\SysWOW64\sc.exe
                                sc start "UserDataSvc_BABACBACACAACBBBABAAABABBBCACACCACAAAABBBABCAACCCCB"
                                3⤵
                                • Launches sc.exe
                                • System Location Discovery: System Language Discovery
                                PID:4892
                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABCCBBABAAABAAABCABACAAABAABCCCCCAABACBCBCAABABAABCB.exe
                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABCCBBABAAABAAABCABACAAABAABCCCCCAABACBCBCAABABAABCB.exe
                            1⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1980
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABAACCABBBBBBAABABCACCBBBCBBABBCABABCCBBBBCBAAABACAAACBCBABBCBACACAAABABBCAACCBACCABBCCAAABBBACCBCAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACCABBBBBBAABABCACCBBBCBBABBCABABCCBBBBCBAAABACAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                              2⤵
                                PID:4928
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABAACCABBBBBBAABABCACCBBBCBBABBCABABCCBBBBCBAAABACAAACBCBABBCBACACAAABABBCAACCBACCABBCCAAABBBACCBCAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACCABBBBBBAABABCACCBBBCBBABBCABABCCBBBBCBAAABACAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                  3⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:5828
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACABBAACACCCBCBBCAACBCCACBBBBCBBBCBCCBBBACCBBABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACCABBBBBBAABABCACCBBBCBBABBCABABCCBBBBCBAAABACAAAC.exe" start= auto displayName= "UserDataSvc_BACABBAACACCCBCBBCAACBCCACBBBBCBBBCBCCBBBACCBBABBCC"
                                2⤵
                                  PID:4472
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc create "UserDataSvc_BACABBAACACCCBCBBCAACBCCACBBBBCBBBCBCCBBBACCBBABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACCABBBBBBAABABCACCBBBCBBABBCABABCCBBBBCBAAABACAAAC.exe" start= auto displayName= "UserDataSvc_BACABBAACACCCBCBBCAACBCCACBBBBCBBBCBCCBBBACCBBABBCC"
                                    3⤵
                                    • Launches sc.exe
                                    PID:1880
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACABBAACACCCBCBBCAACBCCACBBBBCBBBCBCCBBBACCBBABBCC"
                                  2⤵
                                    PID:5040
                                    • C:\Windows\SysWOW64\sc.exe
                                      sc start "UserDataSvc_BACABBAACACCCBCBBCAACBCCACBBBBCBBBCBCCBBBACCBBABBCC"
                                      3⤵
                                      • Launches sc.exe
                                      PID:4564
                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABCCBBABAAABAAABCABACAAABAABCCCCCAABACBCBCAABABAABCB.exe
                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABCCBBABAAABAAABCABACAAABAABCCCCCAABACBCBCAABABAABCB.exe
                                  1⤵
                                  • Drops startup file
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4720
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACCBBCBBABACAACABBBBABCABBBCAAACCBACAABACCBCBAACBAABCBBBBACCBCAABBAACBCBBAACCBAACABCCACBCACACCCCBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABABBCACBBCCAABABBBABBBBBACCBBCCAABBACCCBCCCCBBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                    2⤵
                                      PID:260
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACCBBCBBABACAACABBBBABCABBBCAAACCBACAABACCBCBAACBAABCBBBBACCBCAABBAACBCBBAACCBAACABCCACBCACACCCCBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABABBCACBBCCAABABBBABBBBBACCBBCCAABBACCCBCCCCBBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                        3⤵
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:6988
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCACBBABBBBBBACCBACBABABBABAABABCCCCBBABABCAABBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABABBCACBBCCAABABBBABBBBBACCBBCCAABBACCCBCCCCBBCAA.exe" start= auto displayName= "UserDataSvc_CBBCACBBABBBBBBACCBACBABABBABAABABCCCCBBABABCAABBBA"
                                      2⤵
                                        PID:5216
                                        • C:\Windows\SysWOW64\sc.exe
                                          sc create "UserDataSvc_CBBCACBBABBBBBBACCBACBABABBABAABABCCCCBBABABCAABBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABABBCACBBCCAABABBBABBBBBACCBBCCAABBACCCBCCCCBBCAA.exe" start= auto displayName= "UserDataSvc_CBBCACBBABBBBBBACCBACBABABBABAABABCCCCBBABABCAABBBA"
                                          3⤵
                                            PID:908
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCACBBABBBBBBACCBACBABABBABAABABCCCCBBABABCAABBBA"
                                          2⤵
                                            PID:2884
                                            • C:\Windows\SysWOW64\sc.exe
                                              sc start "UserDataSvc_CBBCACBBABBBBBBACCBACBABABBABAABABCCCCBBABABCAABBBA"
                                              3⤵
                                                PID:2672
                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBCABACABBCCBCCCCBABCBCBACAABCBBAACBCACCBBACABAAACB.exe
                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBCABACABBCCBCCCCBABCBCBACAABCBBAACBCACCBBACABAAACB.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1860
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCAACCACAACBBBBAACABCABACABAABCCBCCCACCACBCABABCCCBAAAACCAABCCCBCBBCBBCAACBBCBCBBABCACACACAACBBBACBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAACCACAACBBBBAACABCABACABAABCCBCCCACCACBCABABCCCBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                              2⤵
                                                PID:1704
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCAACCACAACBBBBAACABCABACABAABCCBCCCACCACBCABABCCCBAAAACCAABCCCBCBBCBBCAACBBCBCBBABCACACACAACBBBACBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAACCACAACBBBBAACABCABACABAABCCBCCCACCACBCABABCCCBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:5324
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBCACBCACBCBBBBBBAABCBBCBBBBCCACCCCBBBBACBABBABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAACCACAACBBBBAACABCABACABAABCCBCCCACCACBCABABCCCBAAA.exe" start= auto displayName= "UserDataSvc_CBCBCACBCACBCBBBBBBAABCBBCBBBBCCACCCCBBBBACBABBABCC"
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:5476
                                                • C:\Windows\SysWOW64\sc.exe
                                                  sc create "UserDataSvc_CBCBCACBCACBCBBBBBBAABCBBCBBBBCCACCCCBBBBACBABBABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAACCACAACBBBBAACABCABACABAABCCBCCCACCACBCABABCCCBAAA.exe" start= auto displayName= "UserDataSvc_CBCBCACBCACBCBBBBBBAABCBBCBBBBCCACCCCBBBBACBABBABCC"
                                                  3⤵
                                                  • Launches sc.exe
                                                  PID:3256
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBCACBCACBCBBBBBBAABCBBCBBBBCCACCCCBBBBACBABBABCC"
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:5684
                                                • C:\Windows\SysWOW64\sc.exe
                                                  sc start "UserDataSvc_CBCBCACBCACBCBBBBBBAABCBBCBBBBCCACCCCBBBBACBABBABCC"
                                                  3⤵
                                                  • Launches sc.exe
                                                  PID:2080
                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCBABBACACABCABBBCCBAABCABCCBAAACACBCBCBBBBABCAACCC.exe
                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCBABBACACABCABBBCCBAABCABCCBAAACACBCBCBBBBABCAACCC.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4828
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCCBBAACBCCACCCABCACCBAABCCACCCACCCBABABACBACAABBABBABABAAABCAACAABABAABABCACCACCABCCBBBACCABBCCCACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCBBAACBCCACCCABCACCBAABCCACCCACCCBABABACBACAABBABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:4252
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCCBBAACBCCACCCABCACCBAABCCACCCACCCBABABACBACAABBABBABABAAABCAACAABABAABABCACCACCABCCBBBACCABBCCCACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCBBAACBCCACCCABCACCBAABCCACCCACCCBABABACBACAABBABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2524
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAACBCACAABABAABABBCBACABCABCCABBABAABCCBABBBCBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCBBAACBCCACCCABCACCBAABCCACCCACCCBABABACBACAABBABBA.exe" start= auto displayName= "UserDataSvc_ABAACBCACAABABAABABBCBACABCABCCABBABAABCCBABBBCBABC"
                                                2⤵
                                                  PID:5000
                                                  • C:\Windows\SysWOW64\sc.exe
                                                    sc create "UserDataSvc_ABAACBCACAABABAABABBCBACABCABCCABBABAABCCBABBBCBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCBBAACBCCACCCABCACCBAABCCACCCACCCBABABACBACAABBABBA.exe" start= auto displayName= "UserDataSvc_ABAACBCACAABABAABABBCBACABCABCCABBABAABCCBABBBCBABC"
                                                    3⤵
                                                    • Launches sc.exe
                                                    • System Location Discovery: System Language Discovery
                                                    PID:7012
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAACBCACAABABAABABBCBACABCABCCABBABAABCCBABBBCBABC"
                                                  2⤵
                                                    PID:3140
                                                    • C:\Windows\SysWOW64\sc.exe
                                                      sc start "UserDataSvc_ABAACBCACAABABAABABBCBACABCABCCABBABAABCCBABBBCBABC"
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:5884
                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACCABBBBBBAABABCACCBBBCBBABBCABABCCBBBBCBAAABACAAAC.exe
                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACCABBBBBBAABABCACCBBBCBBABBCABABCCBBBBCBAAABACAAAC.exe
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:988
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBAACCABCBAACCABBCBCBBBCCABCCBCABCCCABCBACCCABABCBCCAAABCBCCACCBCCBBCACAAABBBBABBACACCACACBCCAACCABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBAACABACCCBACCBABCCBBABACBCACAACBBCCCCCBBCCAAABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                    2⤵
                                                      PID:2796
                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBAACCABCBAACCABBCBCBBBCCABCCBCABCCCABCBACCCABABCBCCAAABCBCCACCBCCBBCACAAABBBBABBACACCACACBCCAACCABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBAACABACCCBACCBABCCBBABACBCACAACBBCCCCCBBCCAAABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                        3⤵
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:3296
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBCCCACABABACCCBCACBBBCBCCCACCBAABBCBABABBBACCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBAACABACCCBACCBABCCBBABACBCACAACBBCCCCCBBCCAAABABA.exe" start= auto displayName= "UserDataSvc_ABBBCCCACABABACCCBCACBBBCBCCCACCBAABBCBABABBBACCCAA"
                                                      2⤵
                                                        PID:6268
                                                        • C:\Windows\SysWOW64\sc.exe
                                                          sc create "UserDataSvc_ABBBCCCACABABACCCBCACBBBCBCCCACCBAABBCBABABBBACCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBAACABACCCBACCBABCCBBABACBCACAACBBCCCCCBBCCAAABABA.exe" start= auto displayName= "UserDataSvc_ABBBCCCACABABACCCBCACBBBCBCCCACCBAABBCBABABBBACCCAA"
                                                          3⤵
                                                          • Launches sc.exe
                                                          PID:5700
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBCCCACABABACCCBCACBBBCBCCCACCBAABBCBABABBBACCCAA"
                                                        2⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:5140
                                                        • C:\Windows\SysWOW64\sc.exe
                                                          sc start "UserDataSvc_ABBBCCCACABABACCCBCACBBBCBCCCACCBAABBCBABABBBACCCAA"
                                                          3⤵
                                                          • Launches sc.exe
                                                          PID:5288
                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABABBCACBBCCAABABBBABBBBBACCBBCCAABBACCCBCCCCBBCAA.exe
                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABABBCACBBCCAABABBBABBBBBACCBBCCAABBACCCBCCCCBBCAA.exe
                                                      1⤵
                                                      • Drops startup file
                                                      • Executes dropped EXE
                                                      • Adds Run key to start application
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2496
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABCBABCCBBABCACBABAAACACBBBAAAABCACBBAACBAAACACBBCABCACAACAACCBCCCABABCBBAABBCACACACCAAAACBCCACCACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCBACCCAAABACCBAAACBABACBCBCBAAACACABBCBABCBCBBBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                        2⤵
                                                          PID:5596
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABCBABCCBBABCACBABAAACACBBBAAAABCACBBAACBAAACACBBCABCACAACAACCBCCCABABCBBAABBCACACACCAAAACBCCACCACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCBACCCAAABACCBAAACBABACBCBCBAAACACABBCBABCBCBBBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                            3⤵
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:6520
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBBACCBBACCBBCACBCACBCBCCACBAABCBABBCCCBCCAAABBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCBACCCAAABACCBAAACBABACBCBCBAAACACABBCBABCBCBBBCBAB.exe" start= auto displayName= "UserDataSvc_BBBBACCBBACCBBCACBCACBCBCCACBAABCBABBCCCBCCAAABBBBC"
                                                          2⤵
                                                            PID:2240
                                                            • C:\Windows\SysWOW64\sc.exe
                                                              sc create "UserDataSvc_BBBBACCBBACCBBCACBCACBCBCCACBAABCBABBCCCBCCAAABBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCBACCCAAABACCBAAACBABACBCBCBAAACACABBCBABCBCBBBCBAB.exe" start= auto displayName= "UserDataSvc_BBBBACCBBACCBBCACBCACBCBCCACBAABCBABBCCCBCCAAABBBBC"
                                                              3⤵
                                                              • Launches sc.exe
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5144
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBBACCBBACCBBCACBCACBCBCCACBAABCBABBCCCBCCAAABBBBC"
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2948
                                                            • C:\Windows\SysWOW64\sc.exe
                                                              sc start "UserDataSvc_BBBBACCBBACCBBCACBCACBCBCCACBAABCBABBCCCBCCAAABBBBC"
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4268
                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABABBCACBBCCAABABBBABBBBBACCBBCCAABBACCCBCCCCBBCAA.exe
                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABABBCACBBCCAABABBBABBBBBACCBBCCAABBACCCBCCCCBBCAA.exe
                                                          1⤵
                                                          • Drops startup file
                                                          • Executes dropped EXE
                                                          • Drops file in System32 directory
                                                          • Drops file in Program Files directory
                                                          • Drops file in Windows directory
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:6220
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBAAABABCBCABAAABBAABBBACCCACACACCABCBAABBBACACBBCABCAACAABBCABCBBBBBABBBBACCBCCACBCCBBBCCBBBCACBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBAAABABCBCABAAABBAABBBACCCACACACCABCBAABBBACACBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                            2⤵
                                                              PID:2620
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBAAABABCBCABAAABBAABBBACCCACACACCABCBAABBBACACBBCABCAACAABBCABCBBBBBABBBBACCBCCACBCCBBBCCBBBCACBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBAAABABCBCABAAABBAABBBACCCACACACCABCBAABBBACACBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                3⤵
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:3820
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCABCCABAAABAABAACBAACABCAAAAAAAABCCACACACBBCBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBAAABABCBCABAAABBAABBBACCCACACACCABCBAABBBACACBBCAB.exe" start= auto displayName= "UserDataSvc_ACBCABCCABAAABAABAACBAACABCAAAAAAAABCCACACACBBCBACA"
                                                              2⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2104
                                                              • C:\Windows\SysWOW64\sc.exe
                                                                sc create "UserDataSvc_ACBCABCCABAAABAABAACBAACABCAAAAAAAABCCACACACBBCBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBAAABABCBCABAAABBAABBBACCCACACACCABCBAABBBACACBBCAB.exe" start= auto displayName= "UserDataSvc_ACBCABCCABAAABAABAACBAACABCAAAAAAAABCCACACACBBCBACA"
                                                                3⤵
                                                                • Launches sc.exe
                                                                PID:1228
                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAACCACAACBBBBAACABCABACABAABCCBCCCACCACBCABABCCCBAAA.exe
                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAACCACAACBBBBAACABCABACABAABCCBCCCACCACBCABABCCCBAAA.exe
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2064
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBAAAABBBAAACCCBBCBCBABABABBCBBBCBBCCCCBACAACCAAACAAACCBABCBBAABBBBAACCAACCAABAACBCACCBCAAABABCACBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBAAAABBBAAACCCBBCBCBABABABBCBBBCBBCCCCBACAACCAAACAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                              2⤵
                                                                PID:1520
                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBAAAABBBAAACCCBBCBCBABABABBCBBBCBBCCCCBACAACCAAACAAACCBABCBBAABBBBAACCAACCAABAACBCACCBCAAABABCACBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBAAAABBBAAACCCBBCBCBABABABBCBBBCBBCCCCBACAACCAAACAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                  3⤵
                                                                  • Scheduled Task/Job: Scheduled Task
                                                                  PID:1432
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACAABBABAACCABBCBBABCCCCCBABBABCABAAAACBCABBBBABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBAAAABBBAAACCCBBCBCBABABABBCBBBCBBCCCCBACAACCAAACAAA.exe" start= auto displayName= "UserDataSvc_ACAABBABAACCABBCBBABCCCCCBABBABCABAAAACBCABBBBABBBC"
                                                                2⤵
                                                                  PID:6904
                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                    sc create "UserDataSvc_ACAABBABAACCABBCBBABCCCCCBABBABCABAAAACBCABBBBABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBAAAABBBAAACCCBBCBCBABABABBCBBBCBBCCCCBACAACCAAACAAA.exe" start= auto displayName= "UserDataSvc_ACAABBABAACCABBCBBABCCCCCBABBABCABAAAACBCABBBBABBBC"
                                                                    3⤵
                                                                    • Launches sc.exe
                                                                    PID:5328
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACAABBABAACCABBCBBABCCCCCBABBABCABAAAACBCABBBBABBBC"
                                                                  2⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:4824
                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                    sc start "UserDataSvc_ACAABBABAACCABBCBBABCCCCCBABBABCABAAAACBCABBBBABBBC"
                                                                    3⤵
                                                                    • Launches sc.exe
                                                                    PID:3480
                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCBBAACBCCACCCABCACCBAABCCACCCACCCBABABACBACAABBABBA.exe
                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCBBAACBCCACCCABCACCBAABCCACCCACCCBABABACBACAABBABBA.exe
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:6172
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCCCACBABCBCBAABBBCCBABBBACACACCCCCCAABAAAACCBBCACBACCAAACCBCACBCACBCCCCBCABBAAACCABBACACBBCCACCBBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCACBABCBCBAABBBCCBABBBACACACCCCCCAABAAAACCBBCACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                  2⤵
                                                                    PID:3620
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCCCACBABCBCBAABBBCCBABBBACACACCCCCCAABAAAACCBBCACBACCAAACCBCACBCACBCCCCBCABBAAACCABBACACBBCCACCBBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCACBABCBCBAABBBCCBABBBACACACCCCCCAABAAAACCBBCACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Scheduled Task/Job: Scheduled Task
                                                                      PID:4400
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBBBABBBCBACACBBAAAACCBCBCACBBCBAABCAAAACACCABCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCACBABCBCBAABBBCCBABBBACACACCCCCCAABAAAACCBBCACBAC.exe" start= auto displayName= "UserDataSvc_ABBBBBABBBCBACACBBAAAACCBCBCACBBCBAABCAAAACACCABCAA"
                                                                    2⤵
                                                                      PID:6956
                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                        sc create "UserDataSvc_ABBBBBABBBCBACACBBAAAACCBCBCACBBCBAABCAAAACACCABCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCACBABCBCBAABBBCCBABBBACACACCCCCCAABAAAACCBBCACBAC.exe" start= auto displayName= "UserDataSvc_ABBBBBABBBCBACACBBAAAACCBCBCACBBCBAABCAAAACACCABCAA"
                                                                        3⤵
                                                                        • Launches sc.exe
                                                                        PID:2572
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBBBABBBCBACACBBAAAACCBCBCACBBCBAABCAAAACACCABCAA"
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:6728
                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                        sc start "UserDataSvc_ABBBBBABBBCBACACBBAAAACCBCBCACBBCBAABCAAAACACCABCAA"
                                                                        3⤵
                                                                          PID:3552
                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBAACABACCCBACCBABCCBBABACBCACAACBBCCCCCBBCCAAABABA.exe
                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBAACABACCCBACCBABCCBBABACBCACAACBBCCCCCBBCCAAABABA.exe
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:780
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCABBCBACCABBCBBCCCCCCABCACBAABBBBCCCACAAABAACABCBCBBCCCCBCCBCBBBACCBCBBBAACABCABBCAAAACABAAAACCABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABBCBACCABBCBBCCCCCCABCACBAABBBBCCCACAAABAACABCBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:4624
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCABBCBACCABBCBBCCCCCCABCACBAABBBBCCCACAAABAACABCBCBBCCCCBCCBCBBBACCBCBBBAACABCABBCAAAACABAAAACCABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABBCBACCABBCBBCCCCCCABCACBAABBBBCCCACAAABAACABCBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                          3⤵
                                                                          • Scheduled Task/Job: Scheduled Task
                                                                          PID:2940
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBBCBACAAACCAABBABABBCBACCABAACCABBAAAABCBBCCCCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABBCBACCABBCBBCCCCCCABCACBAABBBBCCCACAAABAACABCBCBB.exe" start= auto displayName= "UserDataSvc_CBBBCBACAAACCAABBABABBCBACCABAACCABBAAAABCBBCCCCABC"
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2200
                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                          sc create "UserDataSvc_CBBBCBACAAACCAABBABABBCBACCABAACCABBAAAABCBBCCCCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABBCBACCABBCBBCCCCCCABCACBAABBBBCCCACAAABAACABCBCBB.exe" start= auto displayName= "UserDataSvc_CBBBCBACAAACCAABBABABBCBACCABAACCABBAAAABCBBCCCCABC"
                                                                          3⤵
                                                                          • Launches sc.exe
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:5812
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBBCBACAAACCAABBABABBCBACCABAACCABBAAAABCBBCCCCABC"
                                                                        2⤵
                                                                          PID:2800
                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                            sc start "UserDataSvc_CBBBCBACAAACCAABBABABBCBACCABAACCABBAAAABCBBCCCCABC"
                                                                            3⤵
                                                                              PID:4496
                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCBACCCAAABACCBAAACBABACBCBCBAAACACABBCBABCBCBBBCBAB.exe
                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCBACCCAAABACCBAAACBABACBCBCBAAACACABBCBABCBCBBBCBAB.exe
                                                                          1⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:5444
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCBACCAACCBCABCCABACABACCBCACABCBACBACAACCAABAABABCCCCAACABACBCBABBCCABBAACBAACBBCABBACACACABCBCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBBBABBBBBABCACBCABABBCCCABCCCACCBBCCACAAACABABBBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                            2⤵
                                                                              PID:3888
                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCBACCAACCBCABCCABACABACCBCACABCBACBACAACCAABAABABCCCCAACABACBCBABBCCABBAACBAACBBCABBACACACABCBCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBBBABBBBBABCACBCABABBCCCABCCCACCBBCCACAAACABABBBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                3⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                PID:1292
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCACAAAAAABCBABACCBAABACACACCCACACCABABAABACBCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBBBABBBBBABCACBCABABBCCCABCCCACCBBCCACAAACABABBBCBC.exe" start= auto displayName= "UserDataSvc_ACCCACAAAAAABCBABACCBAABACACACCCACACCABABAABACBCBAB"
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2628
                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                sc create "UserDataSvc_ACCCACAAAAAABCBABACCBAABACACACCCACACCABABAABACBCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBBBABBBBBABCACBCABABBCCCABCCCACCBBCCACAAACABABBBCBC.exe" start= auto displayName= "UserDataSvc_ACCCACAAAAAABCBABACCBAABACACACCCACACCABABAABACBCBAB"
                                                                                3⤵
                                                                                • Launches sc.exe
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:6304
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCACAAAAAABCBABACCBAABACACACCCACACCABABAABACBCBAB"
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:3340
                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                sc start "UserDataSvc_ACCCACAAAAAABCBABACCBAABACACACCCACACCABABAABACBCBAB"
                                                                                3⤵
                                                                                • Launches sc.exe
                                                                                PID:5364
                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCBACCABAABABCBBABCBAABAABCCAAABCAAAABCCBCABBBBBCAC.exe
                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCBACCABAABABCBBABCBAABAABCCAAABCAAAABCCBCABBBBBCAC.exe
                                                                            1⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:4672
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCBAABCACCCACACBABAACACACBCBBAACAABACABACBBCBACBCCBCACBABBBACBCBACAABBBBAAACCABBBCABBBCABABACABCBBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBAABCACCCACACBABAACACACBCBBAACAABACABACBBCBACBCCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                              2⤵
                                                                                PID:2872
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCBAABCACCCACACBABAACACACBCBBAACAABACABACBBCBACBCCBCACBABBBACBCBACAABBBBAAACCABBBCABBBCABABACABCBBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBAABCACCCACACBABAACACACBCBBAACAABACABACBBCBACBCCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                  3⤵
                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                  PID:256
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBBCBACCCACAACABBABCBACCCAAABCCCABABCACBBAACACCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBAABCACCCACACBABAACACACBCBBAACAABACABACBBCBACBCCBCA.exe" start= auto displayName= "UserDataSvc_CABBBCBACCCACAACABBABCBACCCAAABCCCABABCACBBAACACCCC"
                                                                                2⤵
                                                                                  PID:3536
                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                    sc create "UserDataSvc_CABBBCBACCCACAACABBABCBACCCAAABCCCABABCACBBAACACCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBAABCACCCACACBABAACACACBCBBAACAABACABACBBCBACBCCBCA.exe" start= auto displayName= "UserDataSvc_CABBBCBACCCACAACABBABCBACCCAAABCCCABABCACBBAACACCCC"
                                                                                    3⤵
                                                                                    • Launches sc.exe
                                                                                    PID:2504
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBBCBACCCACAACABBABCBACCCAAABCCCABABCACBBAACACCCC"
                                                                                  2⤵
                                                                                    PID:2888
                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                      sc start "UserDataSvc_CABBBCBACCCACAACABBABCBACCCAAABCCCABABCACBBAACACCCC"
                                                                                      3⤵
                                                                                      • Launches sc.exe
                                                                                      PID:2020
                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBAAABABCBCABAAABBAABBBACCCACACACCABCBAABBBACACBBCAB.exe
                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBAAABABCBCABAAABBAABBBACCCACACACCABCBAABBBACACBBCAB.exe
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  • Adds Run key to start application
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:2108
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAABCACBAACCAACAABCCBABAACAACCBAACABAAACAABCBABAAABBCBCBCCCACACCCABBCBBACAACCAAAACAACBBBABBBBAACBABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBCACAABBCCBCBAABCBBCCCCCACACBABBBBAACCCCCAABACCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                    2⤵
                                                                                      PID:6532
                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAABCACBAACCAACAABCCBABAACAACCBAACABAAACAABCBABAAABBCBCBCCCACACCCABBCBBACAACCAAAACAACBBBABBBBAACBABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBCACAABBCCBCBAABCBBCCCCCACACBABBBBAACCCCCAABACCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                        3⤵
                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                        PID:2280
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAABCACAAACCCACCCACCBBBCACCCBBABBACBBCCCCABBCAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBCACAABBCCBCBAABCBBCCCCCACACBABBBBAACCCCCAABACCCC.exe" start= auto displayName= "UserDataSvc_AAAABCACAAACCCACCCACCBBBCACCCBBABBACBBCCCCABBCAAABB"
                                                                                      2⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2968
                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                        sc create "UserDataSvc_AAAABCACAAACCCACCCACCBBBCACCCBBABBACBBCCCCABBCAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBCACAABBCCBCBAABCBBCCCCCACACBABBBBAACCCCCAABACCCC.exe" start= auto displayName= "UserDataSvc_AAAABCACAAACCCACCCACCBBBCACCCBBABBACBBCCCCABBCAAABB"
                                                                                        3⤵
                                                                                        • Launches sc.exe
                                                                                        PID:5720
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAABCACAAACCCACCCACCBBBCACCCBBABBACBBCCCCABBCAAABB"
                                                                                      2⤵
                                                                                        PID:6696
                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                          sc start "UserDataSvc_AAAABCACAAACCCACCCACCBBBCACCCBBABBACBBCCCCABBCAAABB"
                                                                                          3⤵
                                                                                          • Launches sc.exe
                                                                                          PID:916
                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBAABBBABBBBCABABBCCABABAACBABAACBBAAAAAAACACBBCAAC.exe
                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBAABBBABBBBCABABBCCABABAACBABAACBBAAAAAAACACBBCAAC.exe
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:1180
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCACBABACBACBABACBBBACAAABAABBCBBCAAABCCACCCBABCCCAABCCBABBBACCCBCABACBBBAABAAAAACCCBCCCCABAACAAAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBABACBBBABBCACCACBBACBBCBCCABABCCACAAABBCCACCCBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                        2⤵
                                                                                          PID:3772
                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCACBABACBACBABACBBBACAAABAABBCBBCAAABCCACCCBABCCCAABCCBABBBACCCBCABACBBBAABAAAAACCCBCCCCABAACAAAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBABACBBBABBCACCACBBACBBCBCCABABCCACAAABBCCACCCBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                            3⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                            PID:6764
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBACACCCCBCCAACCCCBBAAABACBCABBCCACBCBBBBCCCACABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBABACBBBABBCACCACBBACBBCBCCABABCCACAAABBCCACCCBCBB.exe" start= auto displayName= "UserDataSvc_ACBACACCCCBCCAACCCCBBAAABACBCABBCCACBCBBBBCCCACABCC"
                                                                                          2⤵
                                                                                            PID:4884
                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                              sc create "UserDataSvc_ACBACACCCCBCCAACCCCBBAAABACBCABBCCACBCBBBBCCCACABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBABACBBBABBCACCACBBACBBCBCCABABCCACAAABBCCACCCBCBB.exe" start= auto displayName= "UserDataSvc_ACBACACCCCBCCAACCCCBBAAABACBCABBCCACBCBBBBCCCACABCC"
                                                                                              3⤵
                                                                                              • Launches sc.exe
                                                                                              PID:4736
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBACACCCCBCCAACCCCBBAAABACBCABBCCACBCBBBBCCCACABCC"
                                                                                            2⤵
                                                                                              PID:2344
                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                sc start "UserDataSvc_ACBACACCCCBCCAACCCCBBAAABACBCABBCCACBCBBBBCCCACABCC"
                                                                                                3⤵
                                                                                                • Launches sc.exe
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:252
                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBAAAABBBAAACCCBBCBCBABABABBCBBBCBBCCCCBACAACCAAACAAA.exe
                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBAAAABBBAAACCCBBCBCBABABABBCBBBCBBCCCCBACAACCAAACAAA.exe
                                                                                            1⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:6236
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBBACABABBACBBCBBABACACACBCBCAACBBCAABCABCBBBABCBCBBAACBCBBACABCBBBCAAAABCACAABBACCABCABBBABAAACBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBACABABBACBBCBBABACACACBCBCAACBBCAABCABCBBBABCBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                              2⤵
                                                                                                PID:5480
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBBACABABBACBBCBBABACACACBCBCAACBBCAABCABCBBBABCBCBBAACBCBBACABCBBBCAAAABCACAABBACCABCABBBABAAACBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBACABABBACBBCBBABACACACBCBCAACBBCAABCABCBBBABCBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                  3⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:1424
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCCACBABCBBBAACCBAACCBABABCCCABBBCCBCACBCACABCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBACABABBACBBCBBABACACACBCBCAACBBCAABCABCBBBABCBCBB.exe" start= auto displayName= "UserDataSvc_AACCCACBABCBBBAACCBAACCBABABCCCABBBCCBCACBCACABCBCB"
                                                                                                2⤵
                                                                                                  PID:4444
                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                    sc create "UserDataSvc_AACCCACBABCBBBAACCBAACCBABABCCCABBBCCBCACBCACABCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBACABABBACBBCBBABACACACBCBCAACBBCAABCABCBBBABCBCBB.exe" start= auto displayName= "UserDataSvc_AACCCACBABCBBBAACCBAACCBABABCCCABBBCCBCACBCACABCBCB"
                                                                                                    3⤵
                                                                                                      PID:6584
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCCACBABCBBBAACCBAACCBABABCCCABBBCCBCACBCACABCBCB"
                                                                                                    2⤵
                                                                                                      PID:1352
                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                        sc start "UserDataSvc_AACCCACBABCBBBAACCBAACCBABABCCCABBBCCBCACBCACABCBCB"
                                                                                                        3⤵
                                                                                                        • Launches sc.exe
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:6996
                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCACBABCBCBAABBBCCBABBBACACACCCCCCAABAAAACCBBCACBAC.exe
                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCACBABCBCBAABBBCCBABBBACACACCCCCCAABAAAACCBBCACBAC.exe
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1284
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBACABCBCBBCBCCAAAABCCBAABCABACBBACBCCCABCABCAABACACABABBABBABCCABCABCCBCAAAACBBBCABCCBBCBCBACBACCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACABCBCBBCBCCAAAABCCBAABCABACBBACBCCCABCABCAABACACA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                      2⤵
                                                                                                        PID:2380
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBACABCBCBBCBCCAAAABCCBAABCABACBBACBCCCABCABCAABACACABABBABBABCCABCABCCBCAAAACBBBCABCCBBCBCBACBACCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACABCBCBBCBCCAAAABCCBAABCABACBBACBCCCABCABCAABACACA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                          3⤵
                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                          PID:6652
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCABBACCBCAABCABCBACABACBBABCCCCBABABCBBCACCABABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACABCBCBBCBCCAAAABCCBAABCABACBBACBCCCABCABCAABACACA.exe" start= auto displayName= "UserDataSvc_CCCABBACCBCAABCABCBACABACBBABCCCCBABABCBBCACCABABAA"
                                                                                                        2⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:1484
                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                          sc create "UserDataSvc_CCCABBACCBCAABCABCBACABACBBABCCCCBABABCBBCACCABABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACABCBCBBCBCCAAAABCCBAABCABACBBACBCCCABCABCAABACACA.exe" start= auto displayName= "UserDataSvc_CCCABBACCBCAABCABCBACABACBBABCCCCBABABCBBCACCABABAA"
                                                                                                          3⤵
                                                                                                          • Launches sc.exe
                                                                                                          PID:6832
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCABBACCBCAABCABCBACABACBBABCCCCBABABCBBCACCABABAA"
                                                                                                        2⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:4476
                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                          sc start "UserDataSvc_CCCABBACCBCAABCABCBACABACBBABCCCCBABABCBBCACCABABAA"
                                                                                                          3⤵
                                                                                                          • Launches sc.exe
                                                                                                          PID:3860
                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBACABABBACBBCBBABACACACBCBCAACBBCAABCABCBBBABCBCBB.exe
                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBACABABBACBBCBBABACACACBCBCAACBBCAABCABCBBBABCBCBB.exe
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:2360
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABCCCBCBBBBBBCCCBCBAABAAABBBCAAACBACCCCBBCAABACABCBCABAAAABABABCAABACBCCBCBAACAAABBACAACCABCBCACCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABCCCBCBBBBBBCCCBCBAABAAABBBCAAACBACCCCBBCAABACABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                        2⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:6784
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABCCCBCBBBBBBCCCBCBAABAAABBBCAAACBACCCCBBCAABACABCBCABAAAABABABCAABACBCCBCBAACAAABBACAACCABCBCACCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABCCCBCBBBBBBCCCBCBAABAAABBBCAAACBACCCCBBCAABACABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                          3⤵
                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                          PID:2392
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABABCCAAABBAAAABCCCAACBCCAACCBBCBACAABAAACCCBBAAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABCCCBCBBBBBBCCCBCBAABAAABBBCAAACBACCCCBBCAABACABCBC.exe" start= auto displayName= "UserDataSvc_ABABCCAAABBAAAABCCCAACBCCAACCBBCBACAABAAACCCBBAAAAA"
                                                                                                        2⤵
                                                                                                          PID:4452
                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                            sc create "UserDataSvc_ABABCCAAABBAAAABCCCAACBCCAACCBBCBACAABAAACCCBBAAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABCCCBCBBBBBBCCCBCBAABAAABBBCAAACBACCCCBBCAABACABCBC.exe" start= auto displayName= "UserDataSvc_ABABCCAAABBAAAABCCCAACBCCAACCBBCBACAABAAACCCBBAAAAA"
                                                                                                            3⤵
                                                                                                            • Launches sc.exe
                                                                                                            PID:6848
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABABCCAAABBAAAABCCCAACBCCAACCBBCBACAABAAACCCBBAAAAA"
                                                                                                          2⤵
                                                                                                            PID:1472
                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                              sc start "UserDataSvc_ABABCCAAABBAAAABCCCAACBCCAACCBBCBACAABAAACCCBBAAAAA"
                                                                                                              3⤵
                                                                                                                PID:7064
                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABBCBACCABBCBBCCCCCCABCACBAABBBBCCCACAAABAACABCBCBB.exe
                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABBCBACCABBCBBCCCCCCABCACBAABBBBCCCACAAABAACABCBCBB.exe
                                                                                                            1⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:6616
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBBABCACCABCAABABAAAACAAACACBCBABBACBABCACACACCCCCCCABCBBCBCAAACBACBBACCBCCBCACAACABCBBCCBAACCCBCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBCAABACBCBBBAABBBACBACABABAAABBABABABBCCCBABCABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                              2⤵
                                                                                                                PID:6440
                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBBABCACCABCAABABAAAACAAACACBCBABBACBABCACACACCCCCCCABCBBCBCAAACBACBBACCBCCBCACAACABCBBCCBAACCCBCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBCAABACBCBBBAABBBACBACABABAAABBABABABBCCCBABCABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                  3⤵
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:1884
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABCAABAABBAABABACACCABBBCCCBBCBCAAABABBAACACACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBCAABACBCBBBAABBBACBACABABAAABBABABABBCCCBABCABBA.exe" start= auto displayName= "UserDataSvc_BCABCAABAABBAABABACACCABBBCCCBBCBCAAABABBAACACACCAA"
                                                                                                                2⤵
                                                                                                                  PID:5440
                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                    sc create "UserDataSvc_BCABCAABAABBAABABACACCABBBCCCBBCBCAAABABBAACACACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBCAABACBCBBBAABBBACBACABABAAABBABABABBCCCBABCABBA.exe" start= auto displayName= "UserDataSvc_BCABCAABAABBAABABACACCABBBCCCBBCBCAAABABBAACACACCAA"
                                                                                                                    3⤵
                                                                                                                      PID:2016
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABCAABAABBAABABACACCABBBCCCBBCBCAAABABBAACACACCAA"
                                                                                                                    2⤵
                                                                                                                      PID:4520
                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                        sc start "UserDataSvc_BCABCAABAABBAABABACACCABBBCCCBBCBCAAABABBAACACACCAA"
                                                                                                                        3⤵
                                                                                                                        • Launches sc.exe
                                                                                                                        PID:2160
                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACABCBCBBCBCCAAAABCCBAABCABACBBACBCCCABCABCAABACACA.exe
                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACABCBCBBCBCCAAAABCCBAABCABACBBACBCCCABCABCAABACACA.exe
                                                                                                                    1⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:4952
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCAAABCAABAABAACCBBCCCCBCCBBABCBBBBABCBBBACCBABCCCBBCBBCAAACCACCBBBACBABBCBACABCACBBCCACCACBCAAAACCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCCCBBAAACBACAAACCCCACBABCCCBCBAACACCBBCACBACCABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                      2⤵
                                                                                                                        PID:2188
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCAAABCAABAABAACCBBCCCCBCCBBABCBBBBABCBBBACCBABCCCBBCBBCAAACCACCBBBACBABBCBACABCACBBCCACCACBCAAAACCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCCCBBAAACBACAAACCCCACBABCCCBCBAACACCBBCACBACCABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                          3⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                          PID:4932
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCACBABCACABCCACCBCCBCAAABBACAABACCABBACCBCAAAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCCCBBAAACBACAAACCCCACBABCCCBCBAACACCBBCACBACCABBC.exe" start= auto displayName= "UserDataSvc_BBBCACBABCACABCCACCBCCBCAAABBACAABACCABBACCBCAAAACA"
                                                                                                                        2⤵
                                                                                                                          PID:2768
                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                            sc create "UserDataSvc_BBBCACBABCACABCCACCBCCBCAAABBACAABACCABBACCBCAAAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCCCBBAAACBACAAACCCCACBABCCCBCBAACACCBBCACBACCABBC.exe" start= auto displayName= "UserDataSvc_BBBCACBABCACABCCACCBCCBCAAABBACAABACCABBACCBCAAAACA"
                                                                                                                            3⤵
                                                                                                                              PID:4992
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCACBABCACABCCACCBCCBCAAABBACAABACCABBACCBCAAAACA"
                                                                                                                            2⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:2656
                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                              sc start "UserDataSvc_BBBCACBABCACABCCACCBCCBCAAABBACAABACCABBACCBCAAAACA"
                                                                                                                              3⤵
                                                                                                                                PID:3028
                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBBBABBBBBABCACBCABABBCCCABCCCACCBBCCACAAACABABBBCBC.exe
                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBBBABBBBBABCACBCABABBCCCABCCCACCBBCCACAAACABABBBCBC.exe
                                                                                                                            1⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Adds Run key to start application
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:6868
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABACCCBBACCACCCACABBBACAABACBACACBBCACACCCABBABCABAABAABACAAAACBBCAAAAAABBABACBBABACABACABBCBCBCCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABCABCBCBBACBBACBACAACAAACAABCBACACCBBBACAAACCCBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                              2⤵
                                                                                                                                PID:1560
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABACCCBBACCACCCACABBBACAABACBACACBBCACACCCABBABCABAABAABACAAAACBBCAAAAAABBABACBBABACABACABBCBCBCCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABCABCBCBBACBBACBACAACAAACAABCBACACCBBBACAAACCCBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                  3⤵
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:1292
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACCABCBBCBBCCACCBABCACCAAABCBBACABCAAAACACBAAACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABCABCBCBBACBBACBACAACAAACAABCBACACCBBBACAAACCCBCCA.exe" start= auto displayName= "UserDataSvc_BAACCABCBBCBBCCACCBABCACCAAABCBBACABCAAAACACBAAACCB"
                                                                                                                                2⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:1760
                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                  sc create "UserDataSvc_BAACCABCBBCBBCCACCBABCACCAAABCBBACABCAAAACACBAAACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABCABCBCBBACBBACBACAACAAACAABCBACACCBBBACAAACCCBCCA.exe" start= auto displayName= "UserDataSvc_BAACCABCBBCBBCCACCBABCACCAAABCBBACABCAAAACACBAAACCB"
                                                                                                                                  3⤵
                                                                                                                                  • Launches sc.exe
                                                                                                                                  PID:5900
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACCABCBBCBBCCACCBABCACCAAABCBBACABCAAAACACBAAACCB"
                                                                                                                                2⤵
                                                                                                                                  PID:1172
                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                    sc start "UserDataSvc_BAACCABCBBCBBCCACCBABCACCAAABCBBACABCAAAACACBAAACCB"
                                                                                                                                    3⤵
                                                                                                                                    • Launches sc.exe
                                                                                                                                    PID:3392
                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBBBABBBBBABCACBCABABBCCCABCCCACCBBCCACAAACABABBBCBC.exe
                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBBBABBBBBABCACBCABABBCCCABCCCACCBBCCACAAACABABBBCBC.exe
                                                                                                                                1⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:4572
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBCABCACCCACCBBBABBBCBCAABBACBCCBBABACBABCCBCACBBABBABBCBAACBCAABBAAABCBCBAAACBCACCACBBCAABCBBACABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCABCACCCACCBBBABBBCBCAABBACBCCBBABACBABCCBCACBBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                  2⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:2092
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBCABCACCCACCBBBABBBCBCAABBACBCCBBABACBABCCBCACBBABBABBCBAACBCAABBAAABCBCBAAACBCACCACBBCAABCBBACABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCABCACCCACCBBBABBBCBCAABBACBCCBBABACBABCCBCACBBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                    3⤵
                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                    PID:1836
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBBCABACABABBAABCAABCAABACCCBACBCBCCABBACBAACAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCABCACCCACCBBBABBBCBCAABBACBCCBBABACBABCCBCACBBABB.exe" start= auto displayName= "UserDataSvc_CCBBBCABACABABBAABCAABCAABACCCBACBCBCCABBACBAACAACA"
                                                                                                                                  2⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:1400
                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                    sc create "UserDataSvc_CCBBBCABACABABBAABCAABCAABACCCBACBCBCCABBACBAACAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCABCACCCACCBBBABBBCBCAABBACBCCBBABACBABCCBCACBBABB.exe" start= auto displayName= "UserDataSvc_CCBBBCABACABABBAABCAABCAABACCCBACBCBCCABBACBAACAACA"
                                                                                                                                    3⤵
                                                                                                                                    • Launches sc.exe
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:2516
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBBCABACABABBAABCAABCAABACCCBACBCBCCABBACBAACAACA"
                                                                                                                                  2⤵
                                                                                                                                    PID:3692
                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                      sc start "UserDataSvc_CCBBBCABACABABBAABCAABCAABACCCBACBCBCCABBACBAACAACA"
                                                                                                                                      3⤵
                                                                                                                                      • Launches sc.exe
                                                                                                                                      PID:2664
                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBAABCACCCACACBABAACACACBCBBAACAABACABACBBCBACBCCBCA.exe
                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBAABCACCCACACBABAACACACBCBBAACAABACABACBBCBACBCCBCA.exe
                                                                                                                                  1⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:1076
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBCCBCCCCCBBCABAABBCABCCACAACACBCBBABBCAACCBABCACCABCCABBCABBBABAABBCABBCBABCACCCABCBCABBCCABCCACACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCCBCCCCCBBCABAABBCABCCACAACACBCBBABBCAACCBABCACCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                    2⤵
                                                                                                                                      PID:4276
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBCCBCCCCCBBCABAABBCABCCACAACACBCBBABBCAACCBABCACCABCCABBCABBBABAABBCABBCBABCACCCABCBCABBCCABCCACACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCCBCCCCCBBCABAABBCABCCACAACACBCBBABBCAACCBABCACCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                        3⤵
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:4284
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCABACBCAACABAACCACBCCAACAABCBACACACABBCABCBCAAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCCBCCCCCBBCABAABBCABCCACAACACBCBBABBCAACCBABCACCABC.exe" start= auto displayName= "UserDataSvc_ABCABACBCAACABAACCACBCCAACAABCBACACACABBCABCBCAAACC"
                                                                                                                                      2⤵
                                                                                                                                        PID:4860
                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                          sc create "UserDataSvc_ABCABACBCAACABAACCACBCCAACAABCBACACACABBCABCBCAAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCCBCCCCCBBCABAABBCABCCACAACACBCBBABBCAACCBABCACCABC.exe" start= auto displayName= "UserDataSvc_ABCABACBCAACABAACCACBCCAACAABCBACACACABBCABCBCAAACC"
                                                                                                                                          3⤵
                                                                                                                                          • Launches sc.exe
                                                                                                                                          PID:3752
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCABACBCAACABAACCACBCCAACAABCBACACACABBCABCBCAAACC"
                                                                                                                                        2⤵
                                                                                                                                          PID:1196
                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                            sc start "UserDataSvc_ABCABACBCAACABAACCACBCCAACAABCBACACACABBCABCBCAAACC"
                                                                                                                                            3⤵
                                                                                                                                            • Launches sc.exe
                                                                                                                                            PID:2936
                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBCACAABBCCBCBAABCBBCCCCCACACBABBBBAACCCCCAABACCCC.exe
                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBCACAABBCCBCBAABCBBCCCCCACACBABBBBAACCCCCAABACCCC.exe
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:6836
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBCAACBBCCBCCABABCBCBCABABABBCCACABBBABBBCBBACBBCCCBBABCAABBABCBABAACACAAABBBACBCCABCCCCABCCACACACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBCAACBBCCBCCABABCBCBCABABABBCCACABBBABBBCBBACBBCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                          2⤵
                                                                                                                                            PID:2732
                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCCCBBAAACBACAAACCCCACBABCCCBCBAACACCBBCACBACCABBC.exe
                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCCCBBAAACBACAAACCCCACBABCCCBCBAACACCBBCACBACCABBC.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:3504
                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBCAABACBCBBBAABBBACBACABABAAABBABABABBCCCBABCABBA.exe
                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABBCAABACBCBBBAABBBACBACABABAAABBABABABBCCCBABCABBA.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:1556
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAABBABBBAABAAAABCACACCACABBACCAABBBACACBCCABBACCCBACBABCBCABBBACCBCBCCCABBAAACAACCCCABABCAAACBCABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBABBBAABAAAABCACACCACABBACCAABBBACACBCCABBACCCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                            2⤵
                                                                                                                                              PID:3904
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAABBABBBAABAAAABCACACCACABBACCAABBBACACBCCABBACCCBACBABCBCABBBACCBCBCCCABBAAACAACCCCABABCAAACBCABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBABBBAABAAAABCACACCACABBACCAABBBACACBCCABBACCCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                3⤵
                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                PID:5968
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCCBABBAABBBBACCCAABABCAACACABBCCCACBCBCBACCCACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBABBBAABAAAABCACACCACABBACCAABBBACACBCCABBACCCBAC.exe" start= auto displayName= "UserDataSvc_CCBCCBABBAABBBBACCCAABABCAACACABBCCCACBCBCBACCCACBB"
                                                                                                                                              2⤵
                                                                                                                                                PID:3332
                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                  sc create "UserDataSvc_CCBCCBABBAABBBBACCCAABABCAACACABBCCCACBCBCBACCCACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBABBBAABAAAABCACACCACABBACCAABBBACACBCCABBACCCBAC.exe" start= auto displayName= "UserDataSvc_CCBCCBABBAABBBBACCCAABABCAACACABBCCCACBCBCBACCCACBB"
                                                                                                                                                  3⤵
                                                                                                                                                  • Launches sc.exe
                                                                                                                                                  PID:1724
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCCBABBAABBBBACCCAABABCAACACABBCCCACBCBCBACCCACBB"
                                                                                                                                                2⤵
                                                                                                                                                  PID:1052
                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                    sc start "UserDataSvc_CCBCCBABBAABBBBACCCAABABCAACACABBCCCACBCBCBACCCACBB"
                                                                                                                                                    3⤵
                                                                                                                                                    • Launches sc.exe
                                                                                                                                                    PID:3660
                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBABACBBBABBCACCACBBACBBCBCCABABCCACAAABBCCACCCBCBB.exe
                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBABACBBBABBCACCACBBACBBCBCCABABCCACAAABBCCACCCBCBB.exe
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:6356
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCACCCCBACBBBAAAAACABBABBABAACBCACCCCCABCABCABCCABCAACCACAABCAACCCCCACACABCCBACBCBBCBBBBCBABACBABACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCACCCCBACBBBAAAAACABBABBABAACBCACCCCCABCABCABCCABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                  2⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:5960
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCACCCCBACBBBAAAAACABBABBABAACBCACCCCCABCABCABCCABCAACCACAABCAACCCCCACACABCCBACBCBBCBBBBCBABACBABACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCACCCCBACBBBAAAAACABBABBABAACBCACCCCCABCABCABCCABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                    3⤵
                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                    PID:4992
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAAABAAABBBACACCABCACBAAABACCACCABABBBCCBABABBABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCACCCCBACBBBAAAAACABBABBABAACBCACCCCCABCABCABCCABCA.exe" start= auto displayName= "UserDataSvc_BBAAABAAABBBACACCABCACBAAABACCACCABABBBCCBABABBABAB"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1028
                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                      sc create "UserDataSvc_BBAAABAAABBBACACCABCACBAAABACCACCABABBBCCBABABBABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCACCCCBACBBBAAAAACABBABBABAACBCACCCCCABCABCABCCABCA.exe" start= auto displayName= "UserDataSvc_BBAAABAAABBBACACCABCACBAAABACCACCABABBBCCBABABBABAB"
                                                                                                                                                      3⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      PID:3168
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAAABAAABBBACACCABCACBAAABACCACCABABBBCCBABABBABAB"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:5932
                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                        sc start "UserDataSvc_BBAAABAAABBBACACCABCACBAAABACCACCABABBBCCBABABBABAB"
                                                                                                                                                        3⤵
                                                                                                                                                        • Launches sc.exe
                                                                                                                                                        PID:4464
                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCACCCCBACBBBAAAAACABBABBABAACBCACCCCCABCABCABCCABCA.exe
                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCACCCCBACBBBAAAAACABBABBABAACBCACCCCCABCABCABCCABCA.exe
                                                                                                                                                    1⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:4616
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBAABCCCBBBBAACCACBABACACAAACACCCCCCBBCCACBCACBBBBBABACCBCCABCBCAABABCCCBCCCACBAABBCCBBBABCBBCCCBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBAABCCCBBBBAACCACBABACACAAACACCCCCCBBCCACBCACBBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                      2⤵
                                                                                                                                                        PID:3180
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBAABCCCBBBBAACCACBABACACAAACACCCCCCBBCCACBCACBBBBBABACCBCCABCBCAABABCCCBCCCACBAABBCCBBBABCBBCCCBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBAABCCCBBBBAACCACBABACACAAACACCCCCCBBCCACBCACBBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                          3⤵
                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                          PID:5104
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCABCBABBCBBAACBCCACCCCBACCBAABAACCCBACBCBABCBAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBAABCCCBBBBAACCACBABACACAAACACCCCCCBBCCACBCACBBBBBA.exe" start= auto displayName= "UserDataSvc_CBCABCBABBCBBAACBCCACCCCBACCBAABAACCCBACBCBABCBAABC"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:4128
                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                            sc create "UserDataSvc_CBCABCBABBCBBAACBCCACCCCBACCBAABAACCCBACBCBABCBAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBAABCCCBBBBAACCACBABACACAAACACCCCCCBBCCACBCACBBBBBA.exe" start= auto displayName= "UserDataSvc_CBCABCBABBCBBAACBCCACCCCBACCBAABAACCCBACBCBABCBAABC"
                                                                                                                                                            3⤵
                                                                                                                                                            • Launches sc.exe
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:2392
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCABCBABBCBBAACBCCACCCCBACCBAABAACCCBACBCBABCBAABC"
                                                                                                                                                          2⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:1708
                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                            sc start "UserDataSvc_CBCABCBABBCBBAACBCCACCCCBACCBAABAACCCBACBCBABCBAABC"
                                                                                                                                                            3⤵
                                                                                                                                                            • Launches sc.exe
                                                                                                                                                            PID:5496
                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBABBBAABAAAABCACACCACABBACCAABBBACACBCCABBACCCBAC.exe
                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBABBBAABAAAABCACACCACABBACCAABBBACACBCCABBACCCBAC.exe
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:5892
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBAABBBABBCBCBAACBCABCABABBBABACACACACACBBAACABCAAABABBCCBCACABABCCBCCACABACBABABCBCBABCBACCACCBBABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBAABBBABBCBCBAACBCABCABABBBABACACACACACBBAACABCAAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                          2⤵
                                                                                                                                                            PID:6592
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBAABBBABBCBCBAACBCABCABABBBABACACACACACBBAACABCAAABABBCCBCACABABCCBCCACABACBABABCBCBABCBACCACCBBABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBAABBBABBCBCBAACBCABCABABBBABACACACACACBBAACABCAAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                              3⤵
                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                              PID:3300
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACCBCBAABBAAAACCCCCBBCABBCACCBCCCBCBBCABACABBBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBAABBBABBCBCBAACBCABCABABBBABACACACACACBBAACABCAAABA.exe" start= auto displayName= "UserDataSvc_CBACCBCBAABBAAAACCCCCBBCABBCACCBCCCBCBBCABACABBBAAB"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:3168
                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                sc create "UserDataSvc_CBACCBCBAABBAAAACCCCCBBCABBCACCBCCCBCBBCABACABBBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBAABBBABBCBCBAACBCABCABABBBABACACACACACBBAACABCAAABA.exe" start= auto displayName= "UserDataSvc_CBACCBCBAABBAAAACCCCCBBCABBCACCBCCCBCBBCABACABBBAAB"
                                                                                                                                                                3⤵
                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                PID:1048
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACCBCBAABBAAAACCCCCBBCABBCACCBCCCBCBBCABACABBBAAB"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:6216
                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                  sc start "UserDataSvc_CBACCBCBAABBAAAACCCCCBBCABBCACCBCCCBCBBCABACABBBAAB"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:1880
                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABCCCBCBBBBBBCCCBCBAABAAABBBCAAACBACCCCBBCAABACABCBC.exe
                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABCCCBCBBBBBBCCCBCBAABAAABBBCAAACBACCCCBBCAABACABCBC.exe
                                                                                                                                                                1⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:4736
                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABCABCBCBBACBBACBACAACAAACAABCBACACCBBBACAAACCCBCCA.exe
                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABCABCBCBBACBBACBACAACAAACAABCBACACCBBBACAAACCCBCCA.exe
                                                                                                                                                                1⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:680
                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCABCACCCACCBBBABBBCBCAABBACBCCBBABACBABCCBCACBBABB.exe
                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCABCACCCACCBBBABBBCBCAABBACBCCBBABACBABCCBCACBBABB.exe
                                                                                                                                                                1⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:124
                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBAABBBABBCBCBAACBCABCABABBBABACACACACACBBAACABCAAABA.exe
                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBAABBBABBCBCBAACBCABCABABBBABACACACACACBBAACABCAAABA.exe
                                                                                                                                                                1⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:1136
                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBAABCCCBBBBAACCACBABACACAAACACCCCCCBBCCACBCACBBBBBA.exe
                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBAABCCCBBBBAACCACBABACACAAACACCCCCCBBCCACBCACBBBBBA.exe
                                                                                                                                                                1⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:5464
                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCCBCCCCCBBCABAABBCABCCACAACACBCBBABBCAACCBABCACCABC.exe
                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCCBCCCCCBBCABAABBCABCCACAACACBCBBABBCAACCBABCACCABC.exe
                                                                                                                                                                1⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:3972

                                                                                                                                                              Network

                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                    Reconnaissance

                                                                                                                                                                    Resource Development

                                                                                                                                                                    Initial Access

                                                                                                                                                                    Execution

                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                    1
                                                                                                                                                                    T1053

                                                                                                                                                                    Scheduled Task

                                                                                                                                                                    1
                                                                                                                                                                    T1053.005

                                                                                                                                                                    System Services

                                                                                                                                                                    1
                                                                                                                                                                    T1569

                                                                                                                                                                    Service Execution

                                                                                                                                                                    1
                                                                                                                                                                    T1569.002

                                                                                                                                                                    Persistence

                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                    1
                                                                                                                                                                    T1547

                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                    1
                                                                                                                                                                    T1547.001

                                                                                                                                                                    Create or Modify System Process

                                                                                                                                                                    1
                                                                                                                                                                    T1543

                                                                                                                                                                    Windows Service

                                                                                                                                                                    1
                                                                                                                                                                    T1543.003

                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                    1
                                                                                                                                                                    T1053

                                                                                                                                                                    Scheduled Task

                                                                                                                                                                    1
                                                                                                                                                                    T1053.005

                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                    1
                                                                                                                                                                    T1547

                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                    1
                                                                                                                                                                    T1547.001

                                                                                                                                                                    Create or Modify System Process

                                                                                                                                                                    1
                                                                                                                                                                    T1543

                                                                                                                                                                    Windows Service

                                                                                                                                                                    1
                                                                                                                                                                    T1543.003

                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                    1
                                                                                                                                                                    T1053

                                                                                                                                                                    Scheduled Task

                                                                                                                                                                    1
                                                                                                                                                                    T1053.005

                                                                                                                                                                    Defense Evasion

                                                                                                                                                                    Modify Registry

                                                                                                                                                                    1
                                                                                                                                                                    T1112

                                                                                                                                                                    Credential Access

                                                                                                                                                                    Credentials from Password Stores

                                                                                                                                                                    1
                                                                                                                                                                    T1555

                                                                                                                                                                    Credentials from Web Browsers

                                                                                                                                                                    1
                                                                                                                                                                    T1555.003

                                                                                                                                                                    Unsecured Credentials

                                                                                                                                                                    1
                                                                                                                                                                    T1552

                                                                                                                                                                    Credentials In Files

                                                                                                                                                                    1
                                                                                                                                                                    T1552.001

                                                                                                                                                                    Discovery

                                                                                                                                                                    System Location Discovery

                                                                                                                                                                    1
                                                                                                                                                                    T1614

                                                                                                                                                                    System Language Discovery

                                                                                                                                                                    1
                                                                                                                                                                    T1614.001

                                                                                                                                                                    Lateral Movement

                                                                                                                                                                    Collection

                                                                                                                                                                    Data from Local System

                                                                                                                                                                    1
                                                                                                                                                                    T1005

                                                                                                                                                                    Command and Control

                                                                                                                                                                    Exfiltration

                                                                                                                                                                    Impact

                                                                                                                                                                    Replay Monitor

                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                    Downloads

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\PerfLogs\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 8f2afb1046325cb7c94bb95c7176d5bc306db46df5fc05026564f7751b3f78ae
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 b9040e49fd934f9f93b12794e88af5b332525edce7b0490ecf39a1aafc2869a3
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-gb\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 fe0d0b36f3858fa975e2d9fafc0f6aa6dbd2974e557a6665f522f826f2826e29
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\nb-no\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 e2d8ec50f6937048518754bbe65a09361a0141dbaf7828ced99ff3e56912cb04
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\identity_proxy\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 d3f65539a1b099a090ffd718d6e3ec448ffa56d1806c794fca16103916c320e9
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 6df0a919c532d8be0dba9843aed94068d559f8ba0756a64aafbc7fa5b5a4a694
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    appvcleaner.exe
                                                                                                                                                                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                                                                                                                                                                    • Size 4.7MB
                                                                                                                                                                    • SHA256 238b8a11f80fbc830cde4d42d585fd74eaf09a0c66bb7d042f9137ff81d399e1
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Program Files\Common Files\microsoft shared\ink\as-IN\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 d83ab7ef1a41737ab6a2c363f422e24548c923da67133ca5b54b40a14511553f
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Program Files\Java\jdk-1.8\jre\bin\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 6556350ac693a666f6d424bd2b63a7d6c6f23630ef3e347e9953e397bcf662e6
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Program Files\Microsoft Office\root\Office16\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 3888312571be022a15205b3b6e1f490b1a5b82dc61d9da71d7610b2c5e53dbf1
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Program Files\Microsoft Office\root\Office16\sdxs\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 0dd955ec0176c04175165880bf9d7a8f16ceef695a718ce7fb8d60bd953670e4
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 0aa7ece129203a78d6596e29d1cb988917ebb7cee82ddf5434f19b0a96cd2177
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 7f5597904b24426f394ecfa18a9c2d97ccf47d5ea5d184023fbb45695e26e656
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-18\ReadOnly\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 92a3a8aaa0f56b50f8a6429d5e01f92f02aaf29f39d12641c694780b9e354aa0
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 f937339946492b7d62b2b5a28e94bc6d9ee2f635180c99c8e571a929a5af23f0
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Travel\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 9f887058464c80c9317b619cd6fa3541a60efa17773dc908a32a1ad608677e78
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\virus_log.txt
                                                                                                                                                                    • Size 1KB
                                                                                                                                                                    • SHA256 ed009f715d172c983b64131a4b37890474b668bbd6c3ad6201d92985b12cdc66
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 288b68d785000d360eba340ce4d75c5d0b2c397ff41dc6e004974ea20d4961a1
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 05929d1c55b3b8d78702f9b1d317e793ec7da31a0e0f4d6dfe21e5e71df7f33f
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 9c041c454bf367b3798ddc3b63030f70bec62e8f06a9a273ea5a68147b3f8824
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    svchost_CBACCCCCBCCABBACBACAABBBCCABAAACBAABAABBBAABABBAACAAAAB.exe
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCCCCBCCABBACBACAABBBCCABAAACBAABAABBBAABABBAACAAAAB.exe
                                                                                                                                                                    • Size 2.6MB
                                                                                                                                                                    • SHA256 1d99b417e05221313f6859a7ede3b247393d0a391e25eceb72a9381ecc134409
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 4KB
                                                                                                                                                                    • SHA256 7dde7b8ade3ca71c3ac895ca9e1e3665b2bcb7fbb84555b73d273709bce5085a
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 5KB
                                                                                                                                                                    • SHA256 a5ec5775ce757037fba9cca4b756e349e406a7df92e91f55655850a434e145b2
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 6KB
                                                                                                                                                                    • SHA256 e64dd98d454341bff37068031452cbc7397810805d73b0a9b5b7291f1e6cd54c
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 6KB
                                                                                                                                                                    • SHA256 2729228597c2c6c2419f4e01d8aa1cfae4a5f773efbf5a067cd975bbf5257dc5
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 6KB
                                                                                                                                                                    • SHA256 aa4516118b8f326f34d601f014a471744e58411e8e246335ae2d75b4d312f3ea
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 6KB
                                                                                                                                                                    • SHA256 9f603f8ac2ea135d162a419dc18c2b88f9ea4b198e9a3d53abcb313cd44a16c5
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 6KB
                                                                                                                                                                    • SHA256 55e8e30d4cf0633b63006d80d8ba4dd11ed790505892cb57cfeb98d2c0c6de8b
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 8KB
                                                                                                                                                                    • SHA256 838dbd677d5c8252457d28e407897879af6b9a27ca1ce31f63310461232cf2a2
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 9KB
                                                                                                                                                                    • SHA256 eb08f173cb2ccba5f37004ea87e30908c205f269f5495bf4476737fd6c85f300
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 10KB
                                                                                                                                                                    • SHA256 46fe89e479ce629f707d018132de05745392e8bf39e7227f7bccdeafb897cc39
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 11KB
                                                                                                                                                                    • SHA256 acb9cb7fd14cc0c40eb060fb36c15dc0e999fa2b7652c2f1b890e6299332637a
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 12KB
                                                                                                                                                                    • SHA256 ca4a6d80af1310b13076fbe849e92169ae41a8ed13ed67b5dcb24270c7ba4250
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 12KB
                                                                                                                                                                    • SHA256 e07df6d1ba5cf17a4bd0cd6b6ee9746897f4e668179a59c7ac741ea02ef5505f
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 13KB
                                                                                                                                                                    • SHA256 19fca4f817ebecb7ffd14abf1a9f194fed5243305fbb1bd4534610fdc4eb2a9c
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 13KB
                                                                                                                                                                    • SHA256 7d3a25b95b3b8d8789e4ce4c6fc73889c459357a8a880b7bbc59f909f3c0a34b
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 13KB
                                                                                                                                                                    • SHA256 111a95c7b9e4adbedbcaf489ed67746716a866f1911623a4eda884454e8318ad
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 14KB
                                                                                                                                                                    • SHA256 71d01e803aa3578cb01b93b98df8c0986d30825a211aa9f578411eb99376f4cd
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 14KB
                                                                                                                                                                    • SHA256 80224158ef9f47ce63b74629dc0cd42d2071cb73ce7514fc4d7cabb13a3b1352
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 15KB
                                                                                                                                                                    • SHA256 4cbb58b5b31b8977dae472de79dc3296d4779075056c53694984cdc8c5e2bf7f
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 15KB
                                                                                                                                                                    • SHA256 22f62b85e0e1113b479d7d5dedb45edc7cbbc07be8f6b52c822fd44c9dd5ade1
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 16KB
                                                                                                                                                                    • SHA256 254331e58b281fd47ef155d1f2f509c94f08546d9b2e538e02756cd85c96e015
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 16KB
                                                                                                                                                                    • SHA256 50689e589823e49f55d81e202ed7d04ec1ade85cee1a0ba7aa5b7fe511e89ec2
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 16KB
                                                                                                                                                                    • SHA256 121988bcbd8afb974374871858f192db4bb47c7d163f5ad5a547c82569c6adfc
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 1KB
                                                                                                                                                                    • SHA256 c8db9f0f0fd2a2a88f556e795d1e4d403ceff51335a5870c70ea5a7a41f94596
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 16KB
                                                                                                                                                                    • SHA256 85f4f4fab1d611f10b1329c17a2b085816dd68d721e0fef9404c8054467231f8
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 1KB
                                                                                                                                                                    • SHA256 314e2c1efc039ac039756886324513c25ec7a0bf5fa862a410f9ff4e3043ed21
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 2KB
                                                                                                                                                                    • SHA256 92423c7def6c01d5889504eda015d9916a710ae4c771ad35888cce59b23255cc
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 2KB
                                                                                                                                                                    • SHA256 e5fab48ba642eb8ef65d17412bdc343ec86714e57a5687a0c7e2441920146f8a
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 3KB
                                                                                                                                                                    • SHA256 6d77a0eece29afed63eff7c2ee36a98f8cc0f79d72490df0d85feca82d55ae7c
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 3KB
                                                                                                                                                                    • SHA256 3c866d9666e610f2b4ae476ad8525d7bed1cb709813d9f8e46fc80aa4d1c5157
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 3KB
                                                                                                                                                                    • SHA256 2b9794f1076e2ddcf4c3ad10ff9e9cd0d56e80a13f31d2fce9ad4d8a286adce9
                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 4KB
                                                                                                                                                                    • SHA256 0fd22452121967f103f831c930880f8f48132bc2858429f2340abc492b964689
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 4KB
                                                                                                                                                                    • SHA256 b87a3a54755583330d801394ffaccb8d23525cc4964c99a5a36a9a8b2c54659c
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 4KB
                                                                                                                                                                    • SHA256 9676e252df06ea12b25ae60da72ae124a95c639984df8dd65f41313bb93fead9
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    virus_log.txt
                                                                                                                                                                    • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                    • Size 4KB
                                                                                                                                                                    • SHA256 846fc02e4e608ef02e40213a274ea351498e2ece2e8b6ef8e2d9ab16d9f4bdc9
                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Windows\INF\PERFLIB\0C0A\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 acb25c00ceeeeb28dcd32e0a2f896959784fa9b9cbc80fb8501b1b3c5f44f268
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 0c8a933d3553a1924a08bec118f7d577539d6ea67d7ef6eea79d0dae1f2c0bc5
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\fr\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 d1e7e49d74fb4a1fc06b63820cbcb0f555b5235196b817615864fb4da425d559
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.resources\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 6e02d6d5e1b3d7b54783e0548e32f651d10297cae7789b57add146c8662066d3
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.Tools\v4.0_4.0.0.0__b03f5f7f11d50a3a\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 bdab8baf1583fa64dcbba96674687733918181c7de01545987b3515f0e1ba105
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 1a54916c0b12d602a121fe6832ae3c1e5ba5852fc3c62e79fc627fe5e00d0557
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    qap`g`v~dtlq
                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P34f388c1#\0e82f9e5b5e049403a569eedd7c11848\qap`g`v~dtlq
                                                                                                                                                                    • Size 10B
                                                                                                                                                                    • SHA256 1a93b806236ae756ababe0bedbace5fd4420d733f55d14bfd563d9180240c152
                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                    Submit Download

                                                                                                                                                                    memory/424-79-0x00000000002F0000-0x0000000000312000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/424-15-0x00000000002F0000-0x0000000000312000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/780-18193-0x0000000000C10000-0x0000000000C32000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/780-7561-0x0000000000C10000-0x0000000000C32000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/988-1711-0x0000000000A80000-0x0000000000AA2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1076-20981-0x0000000000D50000-0x0000000000D72000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1180-20977-0x00000000005C0000-0x00000000005E2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1180-13859-0x00000000005C0000-0x00000000005E2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1284-20922-0x0000000000790000-0x00000000007B2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1556-21063-0x00000000004D0000-0x00000000004F2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1860-301-0x0000000000AA0000-0x0000000000AC2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1860-3357-0x0000000000AA0000-0x0000000000AC2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/1980-299-0x00000000000E0000-0x0000000000102000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2064-4246-0x0000000000280000-0x00000000002A2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2108-13858-0x0000000000DE0000-0x0000000000E02000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2108-20974-0x0000000000DE0000-0x0000000000E02000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2360-20951-0x0000000000A80000-0x0000000000AA2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2360-21051-0x0000000000A80000-0x0000000000AA2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2496-1712-0x0000000000E80000-0x0000000000EA2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2500-142-0x0000000000670000-0x0000000000692000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/2500-103-0x0000000000670000-0x0000000000692000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3212-423-0x00000000000A0000-0x00000000000C2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3212-258-0x00000000000A0000-0x00000000000C2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/3504-21013-0x0000000000330000-0x0000000000352000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4572-20976-0x00000000001E0000-0x0000000000202000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4572-21120-0x00000000001E0000-0x0000000000202000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4596-99-0x0000000000E90000-0x0000000000EB2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4596-169-0x0000000000E90000-0x0000000000EB2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4616-21096-0x00000000007A0000-0x00000000007C2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4620-98-0x0000000000E90000-0x0000000000EB2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4620-190-0x0000000000E90000-0x0000000000EB2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4672-13857-0x00000000000E0000-0x0000000000102000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4672-20972-0x00000000000E0000-0x0000000000102000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4720-300-0x00000000000E0000-0x0000000000102000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4828-3361-0x00000000001F0000-0x0000000000212000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4828-302-0x00000000001F0000-0x0000000000212000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4944-235-0x0000000000780000-0x00000000007A2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/4952-20954-0x0000000000C10000-0x0000000000C32000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5304-266-0x0000000000F80000-0x0000000000FA2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5304-7431-0x0000000000F80000-0x0000000000FA2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5444-20404-0x0000000000840000-0x0000000000862000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5444-12478-0x0000000000840000-0x0000000000862000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5792-0-0x0000000000020000-0x0000000000042000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5792-13-0x0000000000020000-0x0000000000042000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/5892-21124-0x00000000001B0000-0x00000000001D2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6080-100-0x0000000000370000-0x0000000000392000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6092-96-0x00000000002F0000-0x0000000000312000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6092-14-0x00000000002F0000-0x0000000000312000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6172-7550-0x00000000002C0000-0x00000000002E2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6220-11205-0x0000000000E80000-0x0000000000EA2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6220-20902-0x0000000000E80000-0x0000000000EA2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6220-4245-0x0000000000E80000-0x0000000000EA2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6236-20921-0x00000000009C0000-0x00000000009E2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6356-21083-0x0000000001000000-0x0000000001022000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6484-102-0x0000000000670000-0x0000000000692000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6484-141-0x0000000000670000-0x0000000000692000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6616-20952-0x00000000006A0000-0x00000000006C2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6820-236-0x0000000000780000-0x00000000007A2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6836-20985-0x00000000007A0000-0x00000000007C2000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6868-20975-0x00000000001E0000-0x0000000000202000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6868-21123-0x00000000001E0000-0x0000000000202000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6880-234-0x0000000000900000-0x0000000000922000-memory.dmp
                                                                                                                                                                    Download

                                                                                                                                                                    memory/6952-101-0x0000000000370000-0x0000000000392000-memory.dmp
                                                                                                                                                                    Download