Overview

overview

10

Static

static

10

2026-07-14...er.exe

windows10-2004-x64

9

2026-07-14...er.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    130s
  • max time network
    113s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/07/2026, 04:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-14_14321bc5cfd96c785489f6988a42cbba_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
  • Size 11.9MB
  • Sample260714-e4tcgagv8z
  • SHA256 7cbd08964c78ef99bf8c6a73ce1ba86dbc46d6c51b1545f34009214e3a3b8f6f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Detects executables manipulated with Fody 2 IoCs
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Drops startup file 4 IoCs
  • Executes dropped EXE 42 IoCs
  • Adds Run key to start application 2 TTPs 10 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 64 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 49 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-14_14321bc5cfd96c785489f6988a42cbba_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_14321bc5cfd96c785489f6988a42cbba_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABAACCAACCBCCBBBAABBBCCBABCBBABCCBACCCBBCBAAACCBAACBBCBBBCBCCBBACABAABCCABCAACBCBAAABCAABBABAABACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBAABCCCBBCCAACACAACBBBACCBBCCCABABBABBBBACACBAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2360
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABAACCAACCBCCBBBAABBBCCBABCBBABCCBACCCBBCBAAACCBAACBBCBBBCBCCBBACABAABCCABCAACBCBAAABCAABBABAABACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBAABCCCBBCCAACACAACBBBACCBBCCCABABBABBBBACACBAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2756
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCBCCABACBACACCBCBAACCABACAABBCCCABBCBBACAABBBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBAABCCCBBCCAACACAACBBBACCBBCCCABABBABBBBACACBAAACC.exe" start= auto displayName= "UserDataSvc_CACCBCCABACBACACCBCBAACCABACAABBCCCABBCBBACAABBBCBA"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4220
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_CACCBCCABACBACACCBCBAACCABACAABBCCCABBCBBACAABBBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBAABCCCBBCCAACACAACBBBACCBBCCCABABBABBBBACACBAAACC.exe" start= auto displayName= "UserDataSvc_CACCBCCABACBACACCBCBAACCABACAABBCCCABBCBBACAABBBCBA"
        3⤵
        • Launches sc.exe
        PID:5672
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCBCCABACBACACCBCBAACCABACAABBCCCABBCBBACAABBBCBA"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4088
      • C:\Windows\SysWOW64\sc.exe
        sc start "UserDataSvc_CACCBCCABACBACACCBCBAACCABACAABBCCCABBCBBACAABBBCBA"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5052
  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBAABCCCBBCCAACACAACBBBACCBBCCCABABBABBBBACACBAAACC.exe
    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBAABCCCBBCCAACACAACBBBACCBBCCCABABBABBBBACACBAAACC.exe
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4404
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBBABCBBBCCABCBACBBAACCBBBBACBBAAACBBCBAABCABACBCBBAAACCACACCCACCBBABBBCACAAAAAACBCBBABCCCCCABCCCBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBABABAAABCABBACAACBCCBBACCABCCCBBACAAACCBBCABAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5184
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBBABCBBBCCABCBACBBAACCBBBBACBBAAACBBCBAABCABACBCBBAAACCACACCCACCBBABBBCACAAAAAACBCBBABCCCCCABCCCBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBABABAAABCABBACAACBCCBBACCABCCCBBACAAACCBBCABAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2376
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBABAAACBBBBCBBBCBCBCABCBCBBAAACCACBBBCBACCABAABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBABABAAABCABBACAACBCCBBACCABCCCBBACAAACCBBCABAABBC.exe" start= auto displayName= "UserDataSvc_CBBABAAACBBBBCBBBCBCBCABCBCBBAAACCACBBBCBACCABAABAC"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4484
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_CBBABAAACBBBBCBBBCBCBCABCBCBBAAACCACBBBCBACCABAABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBABABAAABCABBACAACBCCBBACCABCCCBBACAAACCBBCABAABBC.exe" start= auto displayName= "UserDataSvc_CBBABAAACBBBBCBBBCBCBCABCBCBBAAACCACBBBCBACCABAABAC"
        3⤵
        • Launches sc.exe
        PID:616
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBABAAACBBBBCBBBCBCBCABCBCBBAAACCACBBBCBACCABAABAC"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2548
      • C:\Windows\SysWOW64\sc.exe
        sc start "UserDataSvc_CBBABAAACBBBBCBBBCBCBCABCBCBBAAACCACBBBCBACCABAABAC"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:624
  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBAABCCCBBCCAACACAACBBBACCBBCCCABABBABBBBACACBAAACC.exe
    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBAABCCCBBCCAACACAACBBBACCBBCCCABABBABBBBACACBAAACC.exe
    1⤵
    • Drops startup file
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3944
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCABAAABCCAACBABBABCACACACACBCAACBAACCACCACAAAACABBCCBCABBBBBCABCABBCCABCCBCBABCCCBCCBCACBACCAACCBCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABAAABCCAACBABBABCACACACACBCAACBAACCACCACAAAACABBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5692
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCABAAABCCAACBABBABCACACACACBCAACBAACCACCACAAAACABBCCBCABBBBBCABCABBCCABCCBCBABCCCBCCBCACBACCAACCBCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABAAABCCAACBABBABCACACACACBCAACBAACCACCACAAAACABBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3688
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCCCBACAABACCCBCABBCBCCBCABBBCBBBACCCCAACCCACBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABAAABCCAACBABBABCACACACACBCAACBAACCACCACAAAACABBCCB.exe" start= auto displayName= "UserDataSvc_CBCCCCBACAABACCCBCABBCBCCBCABBBCBBBACCCCAACCCACBABC"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:692
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_CBCCCCBACAABACCCBCABBCBCCBCABBBCBBBACCCCAACCCACBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABAAABCCAACBABBABCACACACACBCAACBAACCACCACAAAACABBCCB.exe" start= auto displayName= "UserDataSvc_CBCCCCBACAABACCCBCABBCBCCBCABBBCBBBACCCCAACCCACBABC"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:1764
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCCCBACAABACCCBCABBCBCCBCABBBCBBBACCCCAACCCACBABC"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4904
      • C:\Windows\SysWOW64\sc.exe
        sc start "UserDataSvc_CBCCCCBACAABACCCBCABBCBCCBCABBBCBBBACCCCAACCCACBABC"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2724
  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBABABAAABCABBACAACBCCBBACCABCCCBBACAAACCBBCABAABBC.exe
    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBABABAAABCABBACAACBCCBBACCABCCCBBACAAACCBBCABAABBC.exe
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2844
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBAACCBCBBBCBCABAABAAAAABCACABBACCACBBACCACBCCCBBABBACAAACBACBCAACBCABBABBBCABBCBCBCCACACCABACCACABAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACCBCBBBCBCABAABAAAAABCACABBACCACBBACCACBCCCBBABBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5000
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBAACCBCBBBCBCABAABAAAAABCACABBACCACBBACCACBCCCBBABBACAAACBACBCAACBCABBABBBCABBCBCBCCACACCABACCACABAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACCBCBBBCBCABAABAAAAABCACABBACCACBBACCACBCCCBBABBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3152
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCBCBCBABBABCABCCACBAAAABBCBBAACCCCABBABBAAAABAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACCBCBBBCBCABAABAAAAABCACABBACCACBBACCACBCCCBBABBAC.exe" start= auto displayName= "UserDataSvc_BBCCBCBCBABBABCABCCACBAAAABBCBBAACCCCABBABBAAAABAAB"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1300
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_BBCCBCBCBABBABCABCCACBAAAABBCBBAACCCCABBABBAAAABAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACCBCBBBCBCABAABAAAAABCACABBACCACBBACCACBCCCBBABBAC.exe" start= auto displayName= "UserDataSvc_BBCCBCBCBABBABCABCCACBAAAABBCBBAACCCCABBABBAAAABAAB"
        3⤵
          PID:5992
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCBCBCBABBABCABCCACBAAAABBCBBAACCCCABBABBAAAABAAB"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4056
        • C:\Windows\SysWOW64\sc.exe
          sc start "UserDataSvc_BBCCBCBCBABBABCABCCACBAAAABBCBBAACCCCABBABBAAAABAAB"
          3⤵
          • Launches sc.exe
          PID:4820
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABAAABCCAACBABBABCACACACACBCAACBAACCACCACAAAACABBCCB.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABAAABCCAACBABBABCACACACACBCAACBAACCACCACAAAACABBCCB.exe
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1516
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBCCBABCBAAAABCBCCACACCABCCACBCBAACCCAAABCABCABBCBCACAAABCCCBABCCCCABACCBCAABABCBAACBCBAABCCCBCCCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCCBABCBAAAABCBCCACACCABCCACBCBAACCCAAABCABCABBCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2848
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBCCBABCBAAAABCBCCACACCABCCACBCBAACCCAAABCABCABBCBCACAAABCCCBABCCCCABACCBCAABABCBAACBCBAABCCCBCCCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCCBABCBAAAABCBCCACACCABCCACBCBAACCCAAABCABCABBCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:3344
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCCCBCBBCCCBBCBACABBCABCBBCBCABBABCBCAABBBCAAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCCBABCBAAAABCBCCACACCABCCACBCBAACCCAAABCABCABBCBCA.exe" start= auto displayName= "UserDataSvc_ACBCCCBCBBCCCBBCBACABBCABCBBCBCABBABCBCAABBBCAAACBB"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4124
        • C:\Windows\SysWOW64\sc.exe
          sc create "UserDataSvc_ACBCCCBCBBCCCBBCBACABBCABCBBCBCABBABCBCAABBBCAAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCCBABCBAAAABCBCCACACCABCCACBCBAACCCAAABCABCABBCBCA.exe" start= auto displayName= "UserDataSvc_ACBCCCBCBBCCCBBCBACABBCABCBBCBCABBABCBCAABBBCAAACBB"
          3⤵
          • Launches sc.exe
          PID:4440
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCCCBCBBCCCBBCBACABBCABCBBCBCABBABCBCAABBBCAAACBB"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5328
        • C:\Windows\SysWOW64\sc.exe
          sc start "UserDataSvc_ACBCCCBCBBCCCBBCBACABBCABCBBCBCABBABCBCAABBBCAAACBB"
          3⤵
            PID:2796
      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABAAABCCAACBABBABCACACACACBCAACBAACCACCACAAAACABBCCB.exe
        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABAAABCCAACBABBABCACACACACBCAACBAACCACCACAAAACABBCCB.exe
        1⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3752
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABCCCCABCBBBBCCAACBBBCBABBACCBCAACACACCAABCCCABBBACCACBABBABBCBACABBBBCCBACBAABBCBBAACCCAABBCCBACBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCCCABCBBBBCCAACBBBCBABBACCBCAACACACCAABCCCABBBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3264
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABCCCCABCBBBBCCAACBBBCBABBACCBCAACACACCAABCCCABBBACCACBABBABBCBACABBBBCCBACBAABBCBBAACCCAABBCCBACBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCCCABCBBBBCCAACBBBCBABBACCBCAACACACCAABCCCABBBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
            3⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:5404
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCBBAACBBACBAABCCBBCABCABCBACAABABBBCAABCBCBBABABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCCCABCBBBBCCAACBBBCBABBACCBCAACACACCAABCCCABBBACC.exe" start= auto displayName= "UserDataSvc_BBCBBAACBBACBAABCCBBCABCABCBACAABABBBCAABCBCBBABABA"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4788
          • C:\Windows\SysWOW64\sc.exe
            sc create "UserDataSvc_BBCBBAACBBACBAABCCBBCABCABCBACAABABBBCAABCBCBBABABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCCCABCBBBBCCAACBBBCBABBACCBCAACACACCAABCCCABBBACC.exe" start= auto displayName= "UserDataSvc_BBCBBAACBBACBAABCCBBCABCABCBACAABABBBCAABCBCBBABABA"
            3⤵
            • Launches sc.exe
            PID:2764
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCBBAACBBACBAABCCBBCABCABCBACAABABBBCAABCBCBBABABA"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1676
          • C:\Windows\SysWOW64\sc.exe
            sc start "UserDataSvc_BBCBBAACBBACBAABCCBBCABCABCBACAABABBBCAABCBCBBABABA"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2992
      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACCBCBBBCBCABAABAAAAABCACABBACCACBBACCACBCCCBBABBAC.exe
        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACCBCBBBCBCABAABAAAAABCACABBACCACBBACCACBCCCBBABBAC.exe
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4984
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABACAAAABCAACCAABABBBBABACBCABCBACCBAABCBBBBABCCBBCAAABABCCBACABABCABBCBACAABCCBAACABCAAACBCBBCCCBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABAACCCBACCCABABCACBACCAACAABCACCCCACBBCCBBBACCBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:820
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABACAAAABCAACCAABABBBBABACBCABCBACCBAABCBBBBABCCBBCAAABABCCBACABABCABBCBACAABCCBAACABCAAACBCBBCCCBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABAACCCBACCCABABCACBACCAACAABCACCCCACBBCCBBBACCBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5880
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBBAABABBCCCACAABCBACACBACCACAACCBBAABAACBAACBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABAACCCBACCCABABCACBACCAACAABCACCCCACBBCCBBBACCBBAB.exe" start= auto displayName= "UserDataSvc_ABBBBAABABBCCCACAABCBACACBACCACAACCBBAABAACBAACBAAC"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2332
          • C:\Windows\SysWOW64\sc.exe
            sc create "UserDataSvc_ABBBBAABABBCCCACAABCBACACBACCACAACCBBAABAACBAACBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABAACCCBACCCABABCACBACCAACAABCACCCCACBBCCBBBACCBBAB.exe" start= auto displayName= "UserDataSvc_ABBBBAABABBCCCACAABCBACACBACCACAACCBBAABAACBAACBAAC"
            3⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:1972
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBBAABABBCCCACAABCBACACBACCACAACCBBAABAACBAACBAAC"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5936
          • C:\Windows\SysWOW64\sc.exe
            sc start "UserDataSvc_ABBBBAABABBCCCACAABCBACACBACCACAACCBBAABAACBAACBAAC"
            3⤵
            • Launches sc.exe
            PID:2568
      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCCBABCBAAAABCBCCACACCABCCACBCBAACCCAAABCABCABBCBCA.exe
        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBCCBABCBAAAABCBCCACACCABCCACBCBAACCCAAABCABCABBCBCA.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4716
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCCCCCABCAACBBCACBBAAAABABAACBBACBBABABCAACCBACBBAACABBCAAAACABCAABBCCACCABACCCBBBCACBBACBCABAACBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCCCABACACBCCBABCCCCCCCAAABAABCCAAAAAACACBBBCCBABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:752
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCCCCCABCAACBBCACBBAAAABABAACBBACBBABABCAACCBACBBAACABBCAAAACABCAABBCCACCABACCCBBBCACBBACBCABAACBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCCCABACACBCCBABCCCCCCCAAABAABCCAAAAAACACBBBCCBABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3468
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBCBBACABBBCBCBCBCABBCCCBBAAABACBBCABBABBBBCCCBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCCCABACACBCCBABCCCCCCCAAABAABCCAAAAAACACBBBCCBABBC.exe" start= auto displayName= "UserDataSvc_ABBCBBACABBBCBCBCBCABBCCCBBAAABACBBCABBABBBBCCCBCCB"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1352
          • C:\Windows\SysWOW64\sc.exe
            sc create "UserDataSvc_ABBCBBACABBBCBCBCBCABBCCCBBAAABACBBCABBABBBBCCCBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCCCABACACBCCBABCCCCCCCAAABAABCCAAAAAACACBBBCCBABBC.exe" start= auto displayName= "UserDataSvc_ABBCBBACABBBCBCBCBCABBCCCBBAAABACBBCABBABBBBCCCBCCB"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5340
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBCBBACABBBCBCBCBCABBCCCBBAAABACBBCABBABBBBCCCBCCB"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4228
          • C:\Windows\SysWOW64\sc.exe
            sc start "UserDataSvc_ABBCBBACABBBCBCBCBCABBCCCBBAAABACBBCABBABBBBCCCBCCB"
            3⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:2396
      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCCCABCBBBBCCAACBBBCBABBACCBCAACACACCAABCCCABBBACC.exe
        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCCCABCBBBBCCAACBBBCBABBACCBCAACACACCAABCCCABBBACC.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3812
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCCCBCAACBCBAABCCBAABCAAABBBCCBABBBBCABCBAACACBBABACCCAACCCCCCBABBAACABACCAAAAACCCCBBBBAAACCABABBACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCBCAACBCBAABCCBAABCAAABBBCCBABBBBCABCBAACACBBABACC.exe" /sc minute /mo 30 /ru SYSTEM /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4616
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCCCBCAACBCBAABCCBAABCAAABBBCCBABBBBCABCBAACACBBABACCCAACCCCCCBABBAACABACCAAAAACCCCBBBBAAACCABABBACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCBCAACBCBAABCCBAABCAAABBBCCBABBBBCABCBAACACBBABACC.exe" /sc minute /mo 30 /ru SYSTEM /f
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:1088
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBBBCCBABBCBACBAABBABBCCCACABBACBBABABBBACACAAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCBCAACBCBAABCCBAABCAAABBBCCBABBBBCABCBAACACBBABACC.exe" start= auto displayName= "UserDataSvc_BCBBBBCCBABBCBACBAABBABBCCCACABBACBBABABBBACACAAABC"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2620
          • C:\Windows\SysWOW64\sc.exe
            sc create "UserDataSvc_BCBBBBCCBABBCBACBAABBABBCCCACABBACBBABABBBACACAAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCBCAACBCBAABCCBAABCAAABBBCCBABBBBCABCBAACACBBABACC.exe" start= auto displayName= "UserDataSvc_BCBBBBCCBABBCBACBAABBABBCCCACABBACBBABABBBACACAAABC"
            3⤵
            • Launches sc.exe
            PID:3776
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBBBCCBABBCBACBAABBABBCCCACABBACBBABABBBACACAAABC"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4824
          • C:\Windows\SysWOW64\sc.exe
            sc start "UserDataSvc_BCBBBBCCBABBCBACBAABBABBCCCACABBACBBABABBBACACAAABC"
            3⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:4184
      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCCCABCBBBBCCAACBBBCBABBACCBCAACACACCAABCCCABBBACC.exe
        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCCCABCBBBBCCAACBBBCBABBACCBCAACACACCAABCCCABBBACC.exe
        1⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4052
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBBACAABCCBCCCCAAACBCBBAAAAACBCAAABBBBACABABABACAAABBBAACBACBBAACABCACBCAACCCABBACCAACBABABBCCAAABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBACAABCCBCCCCAAACBCBBAAAAACBCAAABBBBACABABABACAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5440
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBBACAABCCBCCCCAAACBCBBAAAAACBCAAABBBBACABABABACAAABBBAACBACBBAACABCACBCAACCCABBACCAACBABABBCCAAABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBACAABCCBCCCCAAACBCBBAAAAACBCAAABBBBACABABABACAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5404
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACCBBBCCABBCACBCCACBABCBBCAABBABBCCCCCCAABABAABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBACAABCCBCCCCAAACBCBBAAAAACBCAAABBBBACABABABACAAAB.exe" start= auto displayName= "UserDataSvc_CBACCBBBCCABBCACBCCACBABCBBCAABBABBCCCCCCAABABAABCA"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4728
          • C:\Windows\SysWOW64\sc.exe
            sc create "UserDataSvc_CBACCBBBCCABBCACBCCACBABCBBCAABBABBCCCCCCAABABAABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBACAABCCBCCCCAAACBCBBAAAAACBCAAABBBBACABABABACAAAB.exe" start= auto displayName= "UserDataSvc_CBACCBBBCCABBCACBCCACBABCBBCAABBABBCCCCCCAABABAABCA"
            3⤵
              PID:3932
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACCBBBCCABBCACBCCACBABCBBCAABBABBCCCCCCAABABAABCA"
            2⤵
              PID:2636
              • C:\Windows\SysWOW64\sc.exe
                sc start "UserDataSvc_CBACCBBBCCABBCACBCCACBABCBBCAABBABBCCCCCCAABABAABCA"
                3⤵
                • Launches sc.exe
                PID:1948
          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABAACCCBACCCABABCACBACCAACAABCACCCCACBBCCBBBACCBBAB.exe
            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABAACCCBACCCABABCACBACCAACAABCACCCCACBBCCBBBACCBBAB.exe
            1⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5496
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABABACAAABCCAABCBCBBAACABBCBCACBCBBAABABAACBBBCACCBBCBCCAABBACBAAACACABAACAACAACBCCBABBCBBAAAAACBCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCAACACBBCACCACACBBCABABABACACACBBABACAACCACAAACBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3324
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABABACAAABCCAABCBCBBAACABBCBCACBCBBAABABAACBBBCACCBBCBCCAABBACBAAACACABAACAACAACBCCBABBCBBAAAAACBCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCAACACBBCACCACACBBCABABABACACACBBABACAACCACAAACBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                3⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:6028
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACABCACABBBCCACCCACBCBCBBCCCAAABACCABACBACACCBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCAACACBBCACCACACBBCABABABACACACBBABACAACCACAAACBAAB.exe" start= auto displayName= "UserDataSvc_ABACABCACABBBCCACCCACBCBCBBCCCAAABACCABACBACACCBACA"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4492
              • C:\Windows\SysWOW64\sc.exe
                sc create "UserDataSvc_ABACABCACABBBCCACCCACBCBCBBCCCAAABACCABACBACACCBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCAACACBBCACCACACBBCABABABACACACBBABACAACCACAAACBAAB.exe" start= auto displayName= "UserDataSvc_ABACABCACABBBCCACCCACBCBCBBCCCAAABACCABACBACACCBACA"
                3⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:4144
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACABCACABBBCCACCCACBCBCBBCCCAAABACCABACBACACCBACA"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:5376
              • C:\Windows\SysWOW64\sc.exe
                sc start "UserDataSvc_ABACABCACABBBCCACCCACBCBCBBCCCAAABACCABACBACACCBACA"
                3⤵
                • Launches sc.exe
                PID:5632
          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCCCABACACBCCBABCCCCCCCAAABAABCCAAAAAACACBBBCCBABBC.exe
            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCCCABACACBCCBABCCCCCCCAAABAABCCAAAAAACACBBBCCBABBC.exe
            1⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3836
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCABAABCCCACCCCCBBCCABBCBBCAACCBBACCBBCACBBBCBCABAAAAAAABCBCABBAACBCACBCCBACCAAACACABCBACACCCBBACABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCABAABCCCACCCCCBBCCABBCBBCAACCBBACCBBCACBBBCBCABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
              2⤵
                PID:2148
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCABAABCCCACCCCCBBCCABBCBBCAACCBBACCBBCACBBBCBCABAAAAAAABCBCABBAACBCACBCCBACCAAACACABCBACACCCBBACABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCABAABCCCACCCCCBBCCABBCBBCAACCBBACCBBCACBBBCBCABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:4296
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBCBBCCBCBCABBAAAACACAACAABAAACBAAABABAABAAACAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCABAABCCCACCCCCBBCCABBCBBCAACCBBACCBBCACBBBCBCABAAA.exe" start= auto displayName= "UserDataSvc_BCCBCBBCCBCBCABBAAAACACAACAABAAACBAAABABAABAAACAACB"
                2⤵
                  PID:3820
                  • C:\Windows\SysWOW64\sc.exe
                    sc create "UserDataSvc_BCCBCBBCCBCBCABBAAAACACAACAABAAACBAAABABAABAAACAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCABAABCCCACCCCCBBCCABBCBBCAACCBBACCBBCACBBBCBCABAAA.exe" start= auto displayName= "UserDataSvc_BCCBCBBCCBCBCABBAAAACACAACAABAAACBAAABABAABAAACAACB"
                    3⤵
                    • Launches sc.exe
                    PID:2728
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBCBBCCBCBCABBAAAACACAACAABAAACBAAABABAABAAACAACB"
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:6056
                  • C:\Windows\SysWOW64\sc.exe
                    sc start "UserDataSvc_BCCBCBBCCBCBCABBAAAACACAACAABAAACBAAABABAABAAACAACB"
                    3⤵
                      PID:5232
                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCAACACBBCACCACACBBCABABABACACACBBABACAACCACAAACBAAB.exe
                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCAACACBBCACCACACBBCABABABACACACBBABACAACCACAAACBAAB.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3296
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBCCACBCCACCCBCAACCACBCBCACCAAAABCCBCBAACBAACABCCBCABCCCACCCCCBCAACBBBBABCCCCAACBCCCAACCCABABBABABCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCBCAACABBBBAAACBBABCCBAABBCAAAAAAABCBCACAAAAACCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                    2⤵
                      PID:4976
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBCCACBCCACCCBCAACCACBCBCACCAAAABCCBCBAACBAACABCCBCABCCCACCCCCBCAACBBBBABCCCCAACBCCCAACCCABABBABABCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCBCAACABBBBAAACBBABCCBAABBCAAAAAAABCBCACAAAAACCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                        3⤵
                        • System Location Discovery: System Language Discovery
                        • Scheduled Task/Job: Scheduled Task
                        PID:5164
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAAACACBBBCBAAACBBACBBBACACABCBCCCCACCBCCACACCAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCBCAACABBBBAAACBBABCCBAABBCAAAAAAABCBCACAAAAACCCCB.exe" start= auto displayName= "UserDataSvc_AAAAACACBBBCBAAACBBACBBBACACABCBCCCCACCBCCACACCAACB"
                      2⤵
                        PID:3436
                        • C:\Windows\SysWOW64\sc.exe
                          sc create "UserDataSvc_AAAAACACBBBCBAAACBBACBBBACACABCBCCCCACCBCCACACCAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCBCAACABBBBAAACBBABCCBAABBCAAAAAAABCBCACAAAAACCCCB.exe" start= auto displayName= "UserDataSvc_AAAAACACBBBCBAAACBBACBBBACACABCBCCCCACCBCCACACCAACB"
                          3⤵
                            PID:1656
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAAACACBBBCBAAACBBACBBBACACABCBCCCCACCBCCACACCAACB"
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:1960
                          • C:\Windows\SysWOW64\sc.exe
                            sc start "UserDataSvc_AAAAACACBBBCBAAACBBACBBBACACABCBCCCCACCBCCACACCAACB"
                            3⤵
                            • Launches sc.exe
                            PID:3320
                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCBCAACBCBAABCCBAABCAAABBBCCBABBBBCABCBAACACBBABACC.exe
                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCBCAACBCBAABCCBAABCAAABBBCCBABBBBCABCBAACACBBABACC.exe
                        1⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1220
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBBBBBCCAABBABCCACABCCCABAAABCACAACAAACCAAABACCCAAABBCCBCAACCCBCABACBACBBBBBCBACBCAABABAAACCBBCCCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBBBBCCAABBABCCACABCCCABAAABCACAACAAACCAAABACCCAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                          2⤵
                            PID:3480
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBBBBBCCAABBABCCACABCCCABAAABCACAACAAACCAAABACCCAAABBCCBCAACCCBCABACBACBBBBBCBACBCAABABAAACCBBCCCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBBBBCCAABBABCCACABCCCABAAABCACAACAAACCAAABACCCAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Scheduled Task/Job: Scheduled Task
                              PID:3004
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABAAAACACCBBBAACCAAACACCBACCCCBAACCCCBAACACBCCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBBBBCCAABBABCCACABCCCABAAABCACAACAAACCAAABACCCAAAB.exe" start= auto displayName= "UserDataSvc_CBABAAAACACCBBBAACCAAACACCBACCCCBAACCCCBAACACBCCBAB"
                            2⤵
                              PID:6048
                              • C:\Windows\SysWOW64\sc.exe
                                sc create "UserDataSvc_CBABAAAACACCBBBAACCAAACACCBACCCCBAACCCCBAACACBCCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBBBBCCAABBABCCACABCCCABAAABCACAACAAACCAAABACCCAAAB.exe" start= auto displayName= "UserDataSvc_CBABAAAACACCBBBAACCAAACACCBACCCCBAACCCCBAACACBCCBAB"
                                3⤵
                                • Launches sc.exe
                                PID:428
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABAAAACACCBBBAACCAAACACCBACCCCBAACCCCBAACACBCCBAB"
                              2⤵
                                PID:5484
                                • C:\Windows\SysWOW64\sc.exe
                                  sc start "UserDataSvc_CBABAAAACACCBBBAACCAAACACCBACCCCBAACCCCBAACACBCCBAB"
                                  3⤵
                                  • Launches sc.exe
                                  PID:4212
                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBACAABCCBCCCCAAACBCBBAAAAACBCAAABBBBACABABABACAAAB.exe
                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBACAABCCBCCCCAAACBCBBAAAAACBCAAABBBBACABABABACAAAB.exe
                              1⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5852
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABBBBAACCBCCBBBABBBACAABABABACACACBCCCCCAABBBCACACBCBCACBBAAABBAAACAACBCCBABBBCCACBCCAABBCABCCBCCACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCCABBABABCBAABBAAABCBCBBAACAABACBAAACCCBBCBCCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                2⤵
                                  PID:2776
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABBBBAACCBCCBBBABBBACAABABABACACACBCCCCCAABBBCACACBCBCACBBAAABBAAACAACBCCBABBBCCACBCCAABBCABCCBCCACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCCABBABABCBAABBAAABCBCBBAACAABACBAAACCCBBCBCCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                    3⤵
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:672
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBBABCACCBCCBBCBBACBACCCBABCBCACAAABBACACBACAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCCABBABABCBAABBAAABCBCBBAACAABACBAAACCCBBCBCCBBB.exe" start= auto displayName= "UserDataSvc_BCCBBABCACCBCCBBCBBACBACCCBABCBCACAAABBACACBACAABBA"
                                  2⤵
                                    PID:1452
                                    • C:\Windows\SysWOW64\sc.exe
                                      sc create "UserDataSvc_BCCBBABCACCBCCBBCBBACBACCCBABCBCACAAABBACACBACAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCCABBABABCBAABBAAABCBCBBAACAABACBAAACCCBBCBCCBBB.exe" start= auto displayName= "UserDataSvc_BCCBBABCACCBCCBBCBBACBACCCBABCBCACAAABBACACBACAABBA"
                                      3⤵
                                        PID:4440
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBBABCACCBCCBBCBBACBACCCBABCBCACAAABBACACBACAABBA"
                                      2⤵
                                        PID:5236
                                        • C:\Windows\SysWOW64\sc.exe
                                          sc start "UserDataSvc_BCCBBABCACCBCCBBCBBACBACCCBABCBCACAAABBACACBACAABBA"
                                          3⤵
                                          • Launches sc.exe
                                          PID:4584
                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCABAABCCCACCCCCBBCCABBCBBCAACCBBACCBBCACBBBCBCABAAA.exe
                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCABAABCCCACCCCCBBCCABBCBBCAACCBBACCBBCACBBBCBCABAAA.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3676
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCCAACABCCBACBBACABABBCACBCBAAAAACBBBABCBAACACBBAACCACBCBBCAACBCACABCACBCCACABCBCAAABCCABACCCCBACCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCABCBCACABCAACBBCBBACACCACACABBCBCCACBAAACCCACAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                        2⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:5404
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCCAACABCCBACBBACABABBCACBCBAAAAACBBBABCBAACACBBAACCACBCBBCAACBCACABCACBCCACABCBCAAABCCABACCCCBACCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCABCBCACABCAACBBCBBACACCACACABBCBCCACBAAACCCACAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                          3⤵
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:5840
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCBAAABCBBBABABACCCAACCCBAAABACBAAAABBABCBBBACCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCABCBCACABCAACBBCBBACACCACACABBCBCCACBAAACCCACAACB.exe" start= auto displayName= "UserDataSvc_CBBCBAAABCBBBABABACCCAACCCBAAABACBAAAABBABCBBBACCBC"
                                        2⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:5672
                                        • C:\Windows\SysWOW64\sc.exe
                                          sc create "UserDataSvc_CBBCBAAABCBBBABABACCCAACCCBAAABACBAAAABBABCBBBACCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCABCBCACABCAACBBCBBACACCACACABBCBCCACBAAACCCACAACB.exe" start= auto displayName= "UserDataSvc_CBBCBAAABCBBBABABACCCAACCCBAAABACBAAAABBABCBBBACCBC"
                                          3⤵
                                          • Launches sc.exe
                                          PID:5508
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCBAAABCBBBABABACCCAACCCBAAABACBAAAABBABCBBBACCBC"
                                        2⤵
                                          PID:1756
                                          • C:\Windows\SysWOW64\sc.exe
                                            sc start "UserDataSvc_CBBCBAAABCBBBABABACCCAACCCBAAABACBAAAABBABCBBBACCBC"
                                            3⤵
                                            • Launches sc.exe
                                            PID:1716
                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCABAABCCCACCCCCBBCCABBCBBCAACCBBACCBBCACBBBCBCABAAA.exe
                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCABAABCCCACCCCCBBCCABBCBBCAACCBBACCBBCACBBBCBCABAAA.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3688
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBCABCBCACABCAACBBCBBACACCACACABBCBCCACBAAACCCACAACBBCCBABABBCBCCCCBBABACAACABCBBBACCBCBABCCBCCBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBCABBCBABAABBBBCBBBAACCABCBCBCABBCCBBBBACAAACACCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                          2⤵
                                            PID:4144
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBCABCBCACABCAACBBCBBACACCACACABBCBCCACBAAACCCACAACBBCCBABABBCBCCCCBBABACAACABCBBBACCBCBABCCBCCBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBCABBCBABAABBBBCBBBAACCABCBCBCABBCCBBBBACAAACACCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                              3⤵
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:5700
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBAAAABAACAAAAABBCAABCCBBCACCCCCABCAAAAABCBAAACAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBCABBCBABAABBBBCBBBAACCABCBCBCABBCCBBBBACAAACACCCA.exe" start= auto displayName= "UserDataSvc_CCBAAAABAACAAAAABBCAABCCBBCACCCCCABCAAAAABCBAAACAAA"
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:1992
                                            • C:\Windows\SysWOW64\sc.exe
                                              sc create "UserDataSvc_CCBAAAABAACAAAAABBCAABCCBBCACCCCCABCAAAAABCBAAACAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBCABBCBABAABBBBCBBBAACCABCBCBCABBCCBBBBACAAACACCCA.exe" start= auto displayName= "UserDataSvc_CCBAAAABAACAAAAABBCAABCCBBCACCCCCABCAAAAABCBAAACAAA"
                                              3⤵
                                              • Launches sc.exe
                                              PID:5056
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBAAAABAACAAAAABBCAABCCBBCACCCCCABCAAAAABCBAAACAAA"
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:3900
                                            • C:\Windows\SysWOW64\sc.exe
                                              sc start "UserDataSvc_CCBAAAABAACAAAAABBCAABCCBBCACCCCCABCAAAAABCBAAACAAA"
                                              3⤵
                                                PID:3156
                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBBBBCCAABBABCCACABCCCABAAABCACAACAAACCAAABACCCAAAB.exe
                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBBBBCCAABBABCCACABCCCABAAABCACAACAAACCAAABACCCAAAB.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:792
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCACCCBBABACBCACABCCAAACBCBACCBCCABACCBAAABCABBBCCCCCABBAABABBCAACBABACBCBACAACBABAABAABBACCABBAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCAAAAAABABCCCBBBAACAABAACBBBABAABABCCAABBCCBCBCCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                              2⤵
                                                PID:1652
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCACCCBBABACBCACABCCAAACBCBACCBCCABACCBAAABCABBBCCCCCABBAABABBCAACBABACBCBACAACBABAABAABBACCABBAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCAAAAAABABCCCBBBAACAABAACBBBABAABABCCAABBCCBCBCCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2712
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCAACAABBCCACBABCAACAABBBBBCACBBBCCABCCAAABABBCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCAAAAAABABCCCBBBAACAABAACBBBABAABABCCAABBCCBCBCCACC.exe" start= auto displayName= "UserDataSvc_CCCAACAABBCCACBABCAACAABBBBBCACBBBCCABCCAAABABBCCCA"
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:2500
                                                • C:\Windows\SysWOW64\sc.exe
                                                  sc create "UserDataSvc_CCCAACAABBCCACBABCAACAABBBBBCACBBBCCABCCAAABABBCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCAAAAAABABCCCBBBAACAABAACBBBABAABABCCAABBCCBCBCCACC.exe" start= auto displayName= "UserDataSvc_CCCAACAABBCCACBABCAACAABBBBBCACBBBCCABCCAAABABBCCCA"
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5672
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCAACAABBCCACBABCAACAABBBBBCACBBBCCABCCAAABABBCCCA"
                                                2⤵
                                                  PID:4172
                                                  • C:\Windows\SysWOW64\sc.exe
                                                    sc start "UserDataSvc_CCCAACAABBCCACBABCAACAABBBBBCACBBBCCABCCAAABABBCCCA"
                                                    3⤵
                                                    • Launches sc.exe
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3068
                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCBCAACABBBBAAACBBABCCBAABBCAAAAAAABCBCACAAAAACCCCB.exe
                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCBCAACABBBBAAACBBABCCBAABBCAAAAAAABCBCACAAAAACCCCB.exe
                                                1⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3616
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABABCACBBABCBABACCCABABCCCBCACCAACAACBABAAACCCCABCAACBAACCCCBACCAABCCACBACBAABCBCBABBCBAABBCBBACBABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABCACBBABCBABACCCABABCCCBCACCAACAACBABAAACCCCABCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                  2⤵
                                                    PID:2036
                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABABCACBBABCBABACCCABABCCCBCACCAACAACBABAAACCCCABCAACBAACCCCBACCAABCCACBACBAABCBCBABBCBAABBCBBACBABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABCACBBABCBABACCCABABCCCBCACCAACAACBABAAACCCCABCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                      3⤵
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4100
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCABBAAAABABCAABABAAAACACACCABACCAACCACAACCACBCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABCACBBABCBABACCCABABCCCBCACCAACAACBABAAACCCCABCAAC.exe" start= auto displayName= "UserDataSvc_BBCABBAAAABABCAABABAAAACACACCABACCAACCACAACCACBCBBB"
                                                    2⤵
                                                      PID:2040
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc create "UserDataSvc_BBCABBAAAABABCAABABAAAACACACCABACCAACCACAACCACBCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABCACBBABCBABACCCABABCCCBCACCAACAACBABAAACCCCABCAAC.exe" start= auto displayName= "UserDataSvc_BBCABBAAAABABCAABABAAAACACACCABACCAACCACAACCACBCBBB"
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:4240
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCABBAAAABABCAABABAAAACACACCABACCAACCACAACCACBCBBB"
                                                      2⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1544
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc start "UserDataSvc_BBCABBAAAABABCAABABAAAACACACCABACCAACCACAACCACBCBBB"
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:5704
                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCCABBABABCBAABBAAABCBCBBAACAABACBAAACCCBBCBCCBBB.exe
                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCCABBABABCBAABBAAABCBCBBAACAABACBAAACCCBBCBCCBBB.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:5668
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCBBBCABCCABBCBAABACACABABCACBBABBCACCBBBBBAABACCCCCCBCCABBBABAACCCBCABBBBAAAABACABCCBCBBBAAABAAAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBBBCABCCABBCBAABACACABABCACBBABBCACCBBBBBAABACCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                      2⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5664
                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCBBBCABCCABBCBAABACACABABCACBBABBCACCBBBBBAABACCCCCCBCCABBBABAACCCBCABBBBAAAABACABCCBCBBBAAABAAAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBBBCABCCABBCBAABACACABABCACBBABBCACCBBBBBAABACCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:3248
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCCAACACBCAAABACBBBBABBCCCBCAABAAACCAAACBBBCAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBBBCABCCABBCBAABACACABABCACBBABBCACCBBBBBAABACCCCC.exe" start= auto displayName= "UserDataSvc_BBBCCAACACBCAAABACBBBBABBCCCBCAABAAACCAAACBBBCAACBB"
                                                      2⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2700
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc create "UserDataSvc_BBBCCAACACBCAAABACBBBBABBCCCBCAABAAACCAAACBBBCAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBBBCABCCABBCBAABACACABABCACBBABBCACCBBBBBAABACCCCC.exe" start= auto displayName= "UserDataSvc_BBBCCAACACBCAAABACBBBBABBCCCBCAABAAACCAAACBBBCAACBB"
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:1412
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCCAACACBCAAABACBBBBABBCCCBCAABAAACCAAACBBBCAACBB"
                                                      2⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4480
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        sc start "UserDataSvc_BBBCCAACACBCAAABACBBBBABBCCCBCAABAAACCAAACBBBCAACBB"
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:5888
                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCCABBABABCBAABBAAABCBCBBAACAABACBAAACCCBBCBCCBBB.exe
                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABCCABBABABCBAABBAAABCBCBBAACAABACBAAACCCBBCBCCBBB.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Adds Run key to start application
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4920
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCABCAABCCBCBBAAACBCBBABCCCBCACBCBCBCCBBBCBCCCCACBCBABBBBBACABCCCCCCBBCBBBAABBCABBACBAACCACBAAABCCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBCACBBAABCACBAAABCBAAAABABBCAABAAAABBBCACBBCABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                      2⤵
                                                        PID:2440
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCABCAABCCBCBBAAACBCBBABCCCBCACBCBCBCCBBBCBCCCCACBCBABBBBBACABCCCCCCBBCBBBAABBCABBACBAACCACBAAABCCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBCACBBAABCACBAAABCBAAAABABBCAABAAAABBBCACBBCABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                          3⤵
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:5568
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABBABACCCBACABBBCABCAABABBBBBCBACBCCABABBBCCBCAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBCACBBAABCACBAAABCBAAAABABBCAABAAAABBBCACBBCABABA.exe" start= auto displayName= "UserDataSvc_BABBABACCCBACABBBCABCAABABBBBBCBACBCCABABBBCCBCAAAB"
                                                        2⤵
                                                          PID:3100
                                                          • C:\Windows\SysWOW64\sc.exe
                                                            sc create "UserDataSvc_BABBABACCCBACABBBCABCAABABBBBBCBACBCCABABBBCCBCAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBCACBBAABCACBAAABCBAAAABABBCAABAAAABBBCACBBCABABA.exe" start= auto displayName= "UserDataSvc_BABBABACCCBACABBBCABCAABABBBBBCBACBCCABABBBCCBCAAAB"
                                                            3⤵
                                                            • Launches sc.exe
                                                            PID:1408
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABBABACCCBACABBBCABCAABABBBBBCBACBCCABABBBCCBCAAAB"
                                                          2⤵
                                                            PID:5656
                                                            • C:\Windows\SysWOW64\sc.exe
                                                              sc start "UserDataSvc_BABBABACCCBACABBBCABCAABABBBBBCBACBCCABABBBCCBCAAAB"
                                                              3⤵
                                                              • Launches sc.exe
                                                              PID:1368
                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABCACBBABCBABACCCABABCCCBCACCAACAACBABAAACCCCABCAAC.exe
                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABCACBBABCBABACCCABABCCCBCACCAACAACBABAAACCCCABCAAC.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2580
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCACBACABACCCBBCAABAACABAABABCABCCAACABBABCAABAAACBCABCCACBBACACBCCBCCBACBCCACBCBBBCBBCCCAACBBAACBCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBACABACCCBBCAABAACABAABABCABCCAACABBABCAABAAACBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                            2⤵
                                                              PID:2724
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCACBACABACCCBBCAABAACABAABABCABCCAACABBABCAABAAACBCABCCACBBACACBCCBCCBACBCCACBCBBBCBBCCCAACBBAACBCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBACABACCCBBCAABAACABAABABCABCCAACABBABCAABAAACBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                3⤵
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:4104
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABABCCCABAABBACCACCABCBBACBCBBBBCCBCCCCBBCCBBCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBACABACCCBBCAABAACABAABABCABCCAACABBABCAABAAACBCAB.exe" start= auto displayName= "UserDataSvc_CCABABCCCABAABBACCACCABCBBACBCBBBBCCBCCCCBBCCBBCABA"
                                                              2⤵
                                                                PID:5828
                                                                • C:\Windows\SysWOW64\sc.exe
                                                                  sc create "UserDataSvc_CCABABCCCABAABBACCACCABCBBACBCBBBBCCBCCCCBBCCBBCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBACABACCCBBCAABAACABAABABCABCCAACABBABCAABAAACBCAB.exe" start= auto displayName= "UserDataSvc_CCABABCCCABAABBACCACCABCBBACBCBBBBCCBCCCCBBCCBBCABA"
                                                                  3⤵
                                                                    PID:4844
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABABCCCABAABBACCACCABCBBACBCBBBBCCBCCCCBBCCBBCABA"
                                                                  2⤵
                                                                    PID:4872
                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                      sc start "UserDataSvc_CCABABCCCABAABBACCACCABCBBACBCBBBBCCBCCCCBBCCBBCABA"
                                                                      3⤵
                                                                      • Launches sc.exe
                                                                      PID:1348
                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABCACBBABCBABACCCABABCCCBCACCAACAACBABAAACCCCABCAAC.exe
                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABCACBBABCBABACCCABABCCCBCACCAACAACBABAAACCCCABCAAC.exe
                                                                  1⤵
                                                                  • Executes dropped EXE
                                                                  • Adds Run key to start application
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:2968
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACBCBBBCBCBCAAACCCCBABBCCBBAACCBCABBAABCAAAABBCBCAAABCAACCCCBABBCCBACCCCCBBCBCCBCBBACCCCBBBACAABABBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBACABACCCBBCAABAACABAABABCABCCAACABBABCAABAAACBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                    2⤵
                                                                      PID:5620
                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACBCBBBCBCBCAAACCCCBABBCCBBAACCBCABBAABCAAAABBCBCAAABCAACCCCBABBCCBACCCCCBBCBCCBCBBACCCCBBBACAABABBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBACABACCCBBCAABAACABAABABCABCCAACABBABCAABAAACBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                        3⤵
                                                                        • Scheduled Task/Job: Scheduled Task
                                                                        PID:4320
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBBCCACCAAABAACBBACCCAAACACCBAACAAAABABCBAABCABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBACABACCCBBCAABAACABAABABCABCCAACABBABCAABAAACBCAB.exe" start= auto displayName= "UserDataSvc_ABBBBCCACCAAABAACBBACCCAAACACCBAACAAAABABCBAABCABBB"
                                                                      2⤵
                                                                        PID:1816
                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                          sc create "UserDataSvc_ABBBBCCACCAAABAACBBACCCAAACACCBAACAAAABABCBAABCABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBACABACCCBBCAABAACABAABABCABCCAACABBABCAABAAACBCAB.exe" start= auto displayName= "UserDataSvc_ABBBBCCACCAAABAACBBACCCAAACACCBAACAAAABABCBAABCABBB"
                                                                          3⤵
                                                                          • Launches sc.exe
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:936
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBBCCACCAAABAACBBACCCAAACACCBAACAAAABABCBAABCABBB"
                                                                        2⤵
                                                                          PID:5752
                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                            sc start "UserDataSvc_ABBBBCCACCAAABAACBBACCCAAACACCBAACAAAABABCBAABCABBB"
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3552
                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBBBCABCCABBCBAABACACABABCACBBABBCACCBBBBBAABACCCCC.exe
                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBBBCABCCABBCBAABACACABABCACBBABBCACCBBBBBAABACCCCC.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:8
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBBBCACBBCBBCABACCBAABBCCBCACAABBBABCABBCBCBBABBACABACBBACBCACABBCCCBCCCCCABAAABBCBBBACBCCCACCBCCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBCACBACBBABBBBCAABACCCABACCBCBACABBCABCAACABABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                          2⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:5728
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBBBCACBBCBBCABACCBAABBCCBCACAABBBABCABBCBCBBABBACABACBBACBCACABBCCCBCCCCCABAAABBCBBBACBCCCACCBCCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBCACBACBBABBBBCAABACCCABACCBCBACABBCABCAACABABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                            3⤵
                                                                            • Scheduled Task/Job: Scheduled Task
                                                                            PID:700
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBBBCAACCACAABACAABAACBBAAABBBCCCCBACACCBCBBABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBCACBACBBABBBBCAABACCCABACCBCBACABBCABCAACABABCAC.exe" start= auto displayName= "UserDataSvc_CCBBBBCAACCACAABACAABAACBBAAABBBCCCCBACACCBCBBABABB"
                                                                          2⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:3864
                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                            sc create "UserDataSvc_CCBBBBCAACCACAABACAABAACBBAAABBBCCCCBACACCBCBBABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBCACBACBBABBBBCAABACCCABACCBCBACABBCABCAACABABCAC.exe" start= auto displayName= "UserDataSvc_CCBBBBCAACCACAABACAABAACBBAAABBBCCCCBACACCBCBBABABB"
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:1664
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBBBCAACCACAABACAABAACBBAAABBBCCCCBACACCBCBBABABB"
                                                                          2⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:5824
                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                            sc start "UserDataSvc_CCBBBBCAACCACAABACAABAACBBAAABBBCCCCBACACCBCBBABABB"
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:2076
                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBCACBBAABCACBAAABCBAAAABABBCAABAAAABBBCACBBCABABA.exe
                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBCACBBAABCACBAAABCBAAAABABBCAABAAAABBBCACBBCABABA.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:5008
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAACBBACBCCBCBCBBABAACACBAAACACABBBBAABBCAAABACBCCBBBBAABACACBBCBBCACCACACCACCBCBCBCBBCCBACBCABCABAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCABCBABCACCBCBACCBBCCACABACAABAAABACCBBBABBBCCAAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                          2⤵
                                                                            PID:3856
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAACBBACBCCBCBCBBABAACACBAAACACABBBBAABBCAAABACBCCBBBBAABACACBBCBBCACCACACCACCBCBCBCBBCCBACBCABCABAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCABCBABCACCBCBACCBBCCACABACAABAAABACCBBBABBBCCAAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                              3⤵
                                                                              • Scheduled Task/Job: Scheduled Task
                                                                              PID:1948
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABABBABBCBBBACBCBBAAAAABABCBBACCAACCACBABBAABCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCABCBABCACCBCBACCBBCCACABACAABAAABACCBBBABBBCCAAABA.exe" start= auto displayName= "UserDataSvc_AAABABBABBCBBBACBCBBAAAAABABCBBACCAACCACBABBAABCBBC"
                                                                            2⤵
                                                                              PID:3252
                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                sc create "UserDataSvc_AAABABBABBCBBBACBCBBAAAAABABCBBACCAACCACBABBAABCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCABCBABCACCBCBACCBBCCACABACAABAAABACCBBBABBBCCAAABA.exe" start= auto displayName= "UserDataSvc_AAABABBABBCBBBACBCBBAAAAABABCBBACCAACCACBABBAABCBBC"
                                                                                3⤵
                                                                                • Launches sc.exe
                                                                                PID:3016
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABABBABBCBBBACBCBBAAAAABABCBBACCAACCACBABBAABCBBC"
                                                                              2⤵
                                                                                PID:4836
                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                  sc start "UserDataSvc_AAABABBABBCBBBACBCBBAAAAABABCBBACCAACCACBABBAABCBBC"
                                                                                  3⤵
                                                                                    PID:3420
                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBCACBBAABCACBAAABCBAAAABABBCAABAAAABBBCACBBCABABA.exe
                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBCACBBAABCACBAAABCBAAAABABBCAABAAAABBBCACBBCABABA.exe
                                                                                1⤵
                                                                                • Executes dropped EXE
                                                                                • Adds Run key to start application
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:2756
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBBCCBCCBABABCAABCBBBBAAABBCBBCCCCCBABBABBBCCAACCBBBAABBACAACABABCABBBAACCCCCCCBCBACCBABBAABABBBACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBACBCCBCBCBBABAACACBAAACACABBBBAABBCAAABACBCCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                  2⤵
                                                                                    PID:4608
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBBCCBCCBABABCAABCBBBBAAABBCBBCCCCCBABBABBBCCAACCBBBAABBACAACABABCABBBAACCCCCCCBCBACCBABBAABABBBACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBACBCCBCBCBBABAACACBAAACACABBBBAABBCAAABACBCCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                      3⤵
                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                      PID:3644
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBACACACCAABBCCBACCCABAAABCCAAACBAACAAABBAACACCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBACBCCBCBCBBABAACACBAAACACABBBBAABBCAAABACBCCBBBB.exe" start= auto displayName= "UserDataSvc_CBBACACACCAABBCCBACCCABAAABCCAAACBAACAAABBAACACCABC"
                                                                                    2⤵
                                                                                      PID:3080
                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                        sc create "UserDataSvc_CBBACACACCAABBCCBACCCABAAABCCAAACBAACAAABBAACACCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBACBCCBCBCBBABAACACBAAACACABBBBAABBCAAABACBCCBBBB.exe" start= auto displayName= "UserDataSvc_CBBACACACCAABBCCBACCCABAAABCCAAACBAACAAABBAACACCABC"
                                                                                        3⤵
                                                                                        • Launches sc.exe
                                                                                        PID:3124
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBACACACCAABBCCBACCCABAAABCCAAACBAACAAABBAACACCABC"
                                                                                      2⤵
                                                                                        PID:5364
                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                          sc start "UserDataSvc_CBBACACACCAABBCCBACCCABAAABCCAAACBAACAAABBAACACCABC"
                                                                                          3⤵
                                                                                            PID:2140
                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCAAAAAABABCCCBBBAACAABAACBBBABAABABCCAABBCCBCBCCACC.exe
                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCAAAAAABABCCCBBBAACAABAACBBBABAABABCCAABBCCBCBCCACC.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:5068
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAABBABCCACCABCACCCCABBBCABBBBABACBACABCBACCCCAAABBABBCBCCABBBCABBCBBCCCBCBBCCAACCABCCABBCCBCBABCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBABCCACCABCACCCCABBBCABBBBABACBACABCBACCCCAAABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                          2⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:5884
                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAABBABCCACCABCACCCCABBBCABBBBABACBACABCBACCCCAAABBABBCBCCABBBCABBCBBCCCBCBBCCAACCABCCABBCCBCBABCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBABCCACCABCACCCCABBBCABBBBABACBACABCBACCCCAAABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                            3⤵
                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                            PID:2780
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABABABCBCCCCACAACCCCCABACCBABCCBACABCBBCCBAABCABCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBABCCACCABCACCCCABBBCABBBBABACBACABCBACCCCAAABBAB.exe" start= auto displayName= "UserDataSvc_ABABABCBCCCCACAACCCCCABACCBABCCBACABCBBCCBAABCABCAB"
                                                                                          2⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:2920
                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                            sc create "UserDataSvc_ABABABCBCCCCACAACCCCCABACCBABCCBACABCBBCCBAABCABCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBABCCACCABCACCCCABBBCABBBBABACBACABCBACCCCAAABBAB.exe" start= auto displayName= "UserDataSvc_ABABABCBCCCCACAACCCCCABACCBABCCBACABCBBCCBAABCABCAB"
                                                                                            3⤵
                                                                                            • Launches sc.exe
                                                                                            PID:5456
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABABABCBCCCCACAACCCCCABACCBABCCBACABCBBCCBAABCABCAB"
                                                                                          2⤵
                                                                                            PID:4432
                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                              sc start "UserDataSvc_ABABABCBCCCCACAACCCCCABACCBABCCBACABCBBCCBAABCABCAB"
                                                                                              3⤵
                                                                                              • Launches sc.exe
                                                                                              PID:4044
                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCAAAAAABABCCCBBBAACAABAACBBBABAABABCCAABBCCBCBCCACC.exe
                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCAAAAAABABCCCBBBAACAABAACBBBABAABABCCAABBCCBCBCCACC.exe
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          • Adds Run key to start application
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:3684
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCAAABCACABACBBCBBACACBCCACABACABCBACACCACCAABBBAABABAACCCBBACCABBACCBBACCBBABCBACCBABAACCAACACBCABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAABCACABACBBCBBACACBCCACABACABCBACACCACCAABBBAABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:5820
                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCAAABCACABACBBCBBACACBCCACABACABCBACACCACCAABBBAABABAACCCBBACCABBACCBBACCBBABCBACCBABAACCAACACBCABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAABCACABACBBCBBACACBCCACABACABCBACACCACCAABBBAABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                              3⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                              PID:5756
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACBBBBBCABBBCCCBCCACBCABBBBBBACAACACCAABCAACCBBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAABCACABACBBCBBACACBCCACABACABCBACACCACCAABBBAABABA.exe" start= auto displayName= "UserDataSvc_AACBBBBBCABBBCCCBCCACBCABBBBBBACAACACCAABCAACCBBBCB"
                                                                                            2⤵
                                                                                              PID:1040
                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                sc create "UserDataSvc_AACBBBBBCABBBCCCBCCACBCABBBBBBACAACACCAABCAACCBBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAABCACABACBBCBBACACBCCACABACABCBACACCACCAABBBAABABA.exe" start= auto displayName= "UserDataSvc_AACBBBBBCABBBCCCBCCACBCABBBBBBACAACACCAABCAACCBBBCB"
                                                                                                3⤵
                                                                                                • Launches sc.exe
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:1216
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACBBBBBCABBBCCCBCCACBCABBBBBBACAACACCAABCAACCBBBCB"
                                                                                              2⤵
                                                                                                PID:1132
                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                  sc start "UserDataSvc_AACBBBBBCABBBCCCBCCACBCABBBBBBACAACACCAABCAACCBBBCB"
                                                                                                  3⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:5128
                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBACABACCCBBCAABAACABAABABCABCCAACABBABCAABAAACBCAB.exe
                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBACABACCCBBCAABAACABAABABCABCCAACABBABCAABAAACBCAB.exe
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:1656
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCAAACBABBABCBCACBBAACCBAACCBBBABABAAACBAACCBCAACACABACCABCCAAAABBAACCCAABBBBAACAACACBCABACBACACBCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBCCCCACBBBCABABCCAACCCBCACBCCBCCBACAAACBBACABBBCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                2⤵
                                                                                                  PID:5644
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCAAACBABBABCBCACBBAACCBAACCBBBABABAAACBAACCBCAACACABACCABCCAAAABBAACCCAABBBBAACAACACBCABACBACACBCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBCCCCACBBBCABABCCAACCCBCACBCCBCCBACAAACBBACABBBCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                    3⤵
                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                    PID:5232
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBABCBCCCCCCCBACCBACBBBACACBBABBABACBCCCAABBBBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBCCCCACBBBCABABCCAACCCBCACBCCBCCBACAAACBBACABBBCAAA.exe" start= auto displayName= "UserDataSvc_BACBABCBCCCCCCCBACCBACBBBACACBBABBABACBCCCAABBBBBBB"
                                                                                                  2⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:5392
                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                    sc create "UserDataSvc_BACBABCBCCCCCCCBACCBACBBBACACBBABBABACBCCCAABBBBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBCCCCACBBBCABABCCAACCCBCACBCCBCCBACAAACBBACABBBCAAA.exe" start= auto displayName= "UserDataSvc_BACBABCBCCCCCCCBACCBACBBBACACBBABBABACBCCCAABBBBBBB"
                                                                                                    3⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:5756
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBABCBCCCCCCCBACCBACBBBACACBBABBABACBCCCAABBBBBBB"
                                                                                                  2⤵
                                                                                                    PID:2856
                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                      sc start "UserDataSvc_BACBABCBCCCCCCCBACCBACBBBACACBBABBABACBCCCAABBBBBBB"
                                                                                                      3⤵
                                                                                                      • Launches sc.exe
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:1216
                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBACABACCCBBCAABAACABAABABCABCCAACABBABCAABAAACBCAB.exe
                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBACABACCCBBCAABAACABAABABCABCCAACABBABCAABAAACBCAB.exe
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in System32 directory
                                                                                                  • Drops file in Program Files directory
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:3468
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBABACCACCCCBBBAAABCCAABBACBCBACACCCBABACCAAABABACBAABCAACBACABAACCCCCBAACBAABACABBCACCABAABBCACBAABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCACAACCABAAAAACBCBCBABCBCACACBACBBABBCCCBACABBCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                    2⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:936
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBABACCACCCCBBBAAABCCAABBACBCBACACCCBABACCAAABABACBAABCAACBACABAACCCCCBAACBAABACABBCACCABAABBCACBAABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCACAACCABAAAAACBCBCBABCBCACACBACBBABBCCCBACABBCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                      3⤵
                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                      PID:5968
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBABCBCCCCCCCBACCBACBBBACACBBABBABACBCCCAABBBBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCACAACCABAAAAACBCBCBABCBCACACBACBBABBCCCBACABBCBAC.exe" start= auto displayName= "UserDataSvc_BACBABCBCCCCCCCBACCBACBBBACACBBABBABACBCCCAABBBBBBB"
                                                                                                    2⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:4116
                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                      sc create "UserDataSvc_BACBABCBCCCCCCCBACCBACBBBACACBBABBABACBCCCAABBBBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCACAACCABAAAAACBCBCBABCBCACACBACBBABBCCCBACABBCBAC.exe" start= auto displayName= "UserDataSvc_BACBABCBCCCCCCCBACCBACBBBACACBBABBABACBCCCAABBBBBBB"
                                                                                                      3⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:6036
                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCABCBCACABCAACBBCBBACACCACACABBCBCCACBAAACCCACAACB.exe
                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCABCBCACABCAACBBCBBACACCACACABBCBCCACBAAACCCACAACB.exe
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:2316
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAAACAABBABCACBAAACACBCCACACCAACABAACBBABBCAAABABBBCBACABCACBCCCCBAAACACABCBCABCBAAACABABABACACCABBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBBCACCCBCBBBAACCACBCCBAAACCBBBBCCACAACCAAAABCACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                    2⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:6148
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAAACAABBABCACBAAACACBCCACACCAACABAACBBABBCAAABABBBCBACABCACBCCCCBAAACACABCBCABCBAAACABABABACACCABBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBBCACCCBCBBBAACCACBCCBAAACCBBBBCCACAACCAAAABCACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                      3⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                      PID:6332
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCBCCABABCABCAACCACACABCCCACAABCACBCBAABAACBBBBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBBCACCCBCBBBAACCACBCCBAAACCBBBBCCACAACCAAAABCACBCC.exe" start= auto displayName= "UserDataSvc_BBCBCCABABCABCAACCACACABCCCACAABCACBCBAABAACBBBBCBA"
                                                                                                    2⤵
                                                                                                      PID:6452
                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                        sc create "UserDataSvc_BBCBCCABABCABCAACCACACABCCCACAABCACBCBAABAACBBBBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBBCACCCBCBBBAACCACBCCBAAACCBBBBCCACAACCAAAABCACBCC.exe" start= auto displayName= "UserDataSvc_BBCBCCABABCABCAACCACACABCCCACAABCACBCBAABAACBBBBCBA"
                                                                                                        3⤵
                                                                                                        • Launches sc.exe
                                                                                                        PID:6740
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCBCCABABCABCAACCACACABCCCACAABCACBCBAABAACBBBBCBA"
                                                                                                      2⤵
                                                                                                        PID:6772
                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                          sc start "UserDataSvc_BBCBCCABABCABCAACCACACABCCCACAABCACBCBAABAACBBBBCBA"
                                                                                                          3⤵
                                                                                                          • Launches sc.exe
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:7092
                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBCABBCBABAABBBBCBBBAACCABCBCBCABBCCBBBBACAAACACCCA.exe
                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBCABBCBABAABBBBCBBBAACCABCBCBCABBCCBBBBACAAACACCCA.exe
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1264
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCCABBBABCABCCBBBBACCBBCBAAACAACBAAACCCAABCCCACAAAACCCCCAABCBAACABBABAAAAAAAACCCBAAABCBAABCABABCCACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABCBBCACCCAABCCCBAAACCACAABCABAACCBCBCCCBCAABCBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                        2⤵
                                                                                                          PID:4888
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCCABBBABCABCCBBBBACCBBCBAAACAACBAAACCCAABCCCACAAAACCCCCAABCBAACABBABAAAAAAAACCCBAAABCBAABCABABCCACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABCBBCACCCAABCCCBAAACCACAABCABAACCBCBCCCBCAABCBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                            3⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                            PID:4584
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBABABCBAABBCCBBBACCAACACACAACCBCCABBCACAABBBAAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABCBBCACCCAABCCCBAAACCACAABCABAACCBCBCCCBCAABCBABC.exe" start= auto displayName= "UserDataSvc_BCBABABCBAABBCCBBBACCAACACACAACCBCCABBCACAABBBAAABA"
                                                                                                          2⤵
                                                                                                            PID:6880
                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                              sc create "UserDataSvc_BCBABABCBAABBCCBBBACCAACACACAACCBCCABBCACAABBBAAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABCBBCACCCAABCCCBAAACCACAABCABAACCBCBCCCBCAABCBABC.exe" start= auto displayName= "UserDataSvc_BCBABABCBAABBCCBBBACCAACACACAACCBCCABBCACAABBBAAABA"
                                                                                                              3⤵
                                                                                                              • Launches sc.exe
                                                                                                              PID:6220
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBABABCBAABBCCBBBACCAACACACAACCBCCABBCACAABBBAAABA"
                                                                                                            2⤵
                                                                                                              PID:6396
                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                sc start "UserDataSvc_BCBABABCBAABBCCBBBACCAACACACAACCBCCABBCACAABBBAAABA"
                                                                                                                3⤵
                                                                                                                • Launches sc.exe
                                                                                                                PID:6728
                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBCABBCBABAABBBBCBBBAACCABCBCBCABBCCBBBBACAAACACCCA.exe
                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBCABBCBABAABBBBCBBBAACCABCBCBCABBCCBBBBACAAACACCCA.exe
                                                                                                            1⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Adds Run key to start application
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:4152
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCCABCACCCBBBABCACBBACACAACACBCCBABCCCACAABCAACBACACACAABBCBBAAAABCBCBBCCBBABAACACBBACACCABBBCACBABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACBBACBBBCAAABACCACCCCACABBBCCCCBAACACCACABCCCBCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                              2⤵
                                                                                                                PID:5296
                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCCABCACCCBBBABCACBBACACAACACBCCBABCCCACAABCAACBACACACAABBCBBAAAABCBCBBCCBBABAACACBBACACCABBBCACBABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACBBACBBBCAAABACCACCCCACABBBCCCCBAACACCACABCCCBCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                  3⤵
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:6716
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACACCAABCBBBCABAABCCCBACBCACABACBCACCACBCAAAACAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACBBACBBBCAAABACCACCCCACABBBCCCCBAACACCACABCCCBCBAC.exe" start= auto displayName= "UserDataSvc_BCACACCAABCBBBCABAABCCCBACBCACABACBCACCACBCAAAACAAC"
                                                                                                                2⤵
                                                                                                                  PID:6892
                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    3⤵
                                                                                                                      PID:6760
                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                      sc create "UserDataSvc_BCACACCAABCBBBCABAABCCCBACBCACABACBCACCACBCAAAACAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACBBACBBBCAAABACCACCCCACABBBCCCCBAACACCACABCCCBCBAC.exe" start= auto displayName= "UserDataSvc_BCACACCAABCBBBCABAABCCCBACBCACABACBCACCACBCAAAACAAC"
                                                                                                                      3⤵
                                                                                                                      • Launches sc.exe
                                                                                                                      PID:6184
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACACCAABCBBBCABAABCCCBACBCACABACBCACCACBCAAAACAAC"
                                                                                                                    2⤵
                                                                                                                      PID:6848
                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                        sc start "UserDataSvc_BCACACCAABCBBBCABAABCCCBACBCACABACBCACCACBCAAAACAAC"
                                                                                                                        3⤵
                                                                                                                        • Launches sc.exe
                                                                                                                        PID:3196
                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBCACBACBBABBBBCAABACCCABACCBCBACABBCABCAACABABCAC.exe
                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBCACBACBBABBBBCAABACCCABACCBCBACABBCABCAACABABCAC.exe
                                                                                                                    1⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:3136
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCCBACABAACACBAABBBBABBCCBABAABACCBAAACCBCCBBBAABCBBCCBACCABCABBCCAABBBCCBABCBACAACBCBCBBBBBABCBACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBACBBABBAAAAACAACCBACACAACBCACABCCCAABABCBBCACCBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                      2⤵
                                                                                                                        PID:7140
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCCBACABAACACBAABBBBABBCCBABAABACCBAAACCBCCBBBAABCBBCCBACCABCABBCCAABBBCCBABCBACAACBCBCBBBBBABCBACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBACBBABBAAAAACAACCBACACAACBCACABCCCAABABCBBCACCBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                          3⤵
                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                          PID:6596
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACACCACBCCBBABAAAACCABCCAAAABCCCCABAABAACABBABCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBACBBABBAAAAACAACCBACACAACBCACABCCCAABABCBBCACCBCCB.exe" start= auto displayName= "UserDataSvc_AACACCACBCCBBABAAAACCABCCAAAABCCCCABAABAACABBABCCCA"
                                                                                                                        2⤵
                                                                                                                          PID:6300
                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                            sc create "UserDataSvc_AACACCACBCCBBABAAAACCABCCAAAABCCCCABAABAACABBABCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBACBBABBAAAAACAACCBACACAACBCACABCCCAABABCBBCACCBCCB.exe" start= auto displayName= "UserDataSvc_AACACCACBCCBBABAAAACCABCCAAAABCCCCABAABAACABBABCCCA"
                                                                                                                            3⤵
                                                                                                                            • Launches sc.exe
                                                                                                                            PID:6456
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACACCACBCCBBABAAAACCABCCAAAABCCCCABAABAACABBABCCCA"
                                                                                                                          2⤵
                                                                                                                            PID:4980
                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                              sc start "UserDataSvc_AACACCACBCCBBABAAAACCABCCAAAABCCCCABAABAACABBABCCCA"
                                                                                                                              3⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              PID:4772
                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBCACBACBBABBBBCAABACCCABACCBCBACABBCABCAACABABCAC.exe
                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCBCACBACBBABBBBCAABACCCABACCBCBACABBCABCAACABABCAC.exe
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:5980
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCCBACABAACACBAABBBBABBCCBABAABACCBAAACCBCCBBBAABCBBCCBACCABCABBCCAABBBCCBABCBACAACBCBCBBBBBABCBACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAAACABBBCACCCCBBABCABCCACBCBBBBBACCBBAACABBACABCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                            2⤵
                                                                                                                              PID:7116
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCCBACABAACACBAABBBBABBCCBABAABACCBAAACCBCCBBBAABCBBCCBACCABCABBCCAABBBCCBABCBACAACBCBCBBBBBABCBACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAAACABBBCACCCCBBABCABCCACBCBBBBBACCBBAACABBACABCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                3⤵
                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                PID:7064
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBBAABBBBCCABBCCBAACACABCCACCBAACAAAAAABBACAAABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAAACABBBCACCCCBBABCABCCACBCBBBBBACCBBAACABBACABCACC.exe" start= auto displayName= "UserDataSvc_BBBBAABBBBCCABBCCBAACACABCCACCBAACAAAAAABBACAAABBAB"
                                                                                                                              2⤵
                                                                                                                                PID:6712
                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                  sc create "UserDataSvc_BBBBAABBBBCCABBCCBAACACABCCACCBAACAAAAAABBACAAABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAAACABBBCACCCCBBABCABCCACBCBBBBBACCBBAACABBACABCACC.exe" start= auto displayName= "UserDataSvc_BBBBAABBBBCCABBCCBAACACABCCACCBAACAAAAAABBACAAABBAB"
                                                                                                                                  3⤵
                                                                                                                                  • Launches sc.exe
                                                                                                                                  PID:2012
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBBAABBBBCCABBCCBAACACABCCACCBAACAAAAAABBACAAABBAB"
                                                                                                                                2⤵
                                                                                                                                  PID:6496
                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                    sc start "UserDataSvc_BBBBAABBBBCCABBCCBAACACABCCACCBAACAAAAAABBACAAABBAB"
                                                                                                                                    3⤵
                                                                                                                                    • Launches sc.exe
                                                                                                                                    PID:5616
                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBACBCCBCBCBBABAACACBAAACACABBBBAABBCAAABACBCCBBBB.exe
                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBACBCCBCBCBBABAACACBAAACACABBBBAABBCAAABACBCCBBBB.exe
                                                                                                                                1⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:3180
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCABAAACCAABABBBACAACAABBABCBCCBBBCCABCAACBBABBACAACABBACBAACABABBBCCCACBBACCCBCCCACCBBCCBBBCAAACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBACCBABACBBAAAAACABABACBCCBABABACBBACBBBABBAABBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                  2⤵
                                                                                                                                    PID:6960
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCABAAACCAABABBBACAACAABBABCBCCBBBCCABCAACBBABBACAACABBACBAACABABBBCCCACBBACCCBCCCACCBBCCBBBCAAACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBACCBABACBBAAAAACABABACBCCBABABACBBACBBBABBAABBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                      3⤵
                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                      PID:720
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBCCACBBCAAABCBBCCBCBCCCBAAABCAACABCBCBBACCBBCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBACCBABACBBAAAAACABABACBCCBABABACBBACBBBABBAABBAAB.exe" start= auto displayName= "UserDataSvc_ACCBCCACBBCAAABCBBCCBCBCCCBAAABCAACABCBCBBACCBBCBAC"
                                                                                                                                    2⤵
                                                                                                                                      PID:7752
                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                        sc create "UserDataSvc_ACCBCCACBBCAAABCBBCCBCBCCCBAAABCAACABCBCBBACCBBCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBACCBABACBBAAAAACABABACBCCBABABACBBACBBBABBAABBAAB.exe" start= auto displayName= "UserDataSvc_ACCBCCACBBCAAABCBBCCBCBCCCBAAABCAACABCBCBBACCBBCBAC"
                                                                                                                                        3⤵
                                                                                                                                        • Launches sc.exe
                                                                                                                                        PID:4792
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBCCACBBCAAABCBBCCBCBCCCBAAABCAACABCBCBBACCBBCBAC"
                                                                                                                                      2⤵
                                                                                                                                        PID:7844
                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                          sc start "UserDataSvc_ACCBCCACBBCAAABCBBCCBCBCCCBAAABCAACABCBCBBACCBBCBAC"
                                                                                                                                          3⤵
                                                                                                                                          • Launches sc.exe
                                                                                                                                          PID:5612
                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBACBCCBCBCBBABAACACBAAACACABBBBAABBCAAABACBCCBBBB.exe
                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBACBCCBCBCBBABAACACBAAACACABBBBAABBCAAABACBCCBBBB.exe
                                                                                                                                      1⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:3904
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACAABABBCACCAAACACAACACAAACBCCABAACCABBCBAABBABCCBABABCBBCCCCCBCCAACACCABBAABCCBBCCCCBABCAACBABACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBCABBAACACABBCCACAAAAABCCCBCCCCBCCABBAAAABCACCACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                        2⤵
                                                                                                                                          PID:6440
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACAABABBCACCAAACACAACACAAACBCCABAACCABBCBAABBABCCBABABCBBCCCCCBCCAACACCABBAABCCBBCCCCBABCAACBABACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBCABBAACACABBCCACAAAAABCCCBCCCCBCCABBAAAABCACCACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                            3⤵
                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                            PID:7800
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAABACBBBACBCCBAACCBCBBACBBAACBCBCCBCCACBBACAAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBCABBAACACABBCCACAAAAABCCCBCCCCBCCABBAAAABCACCACBBB.exe" start= auto displayName= "UserDataSvc_CAAABACBBBACBCCBAACCBCBBACBBAACBCBCCBCCACBBACAAABBA"
                                                                                                                                          2⤵
                                                                                                                                            PID:7352
                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                              sc create "UserDataSvc_CAAABACBBBACBCCBAACCBCBBACBBAACBCBCCBCCACBBACAAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBCABBAACACABBCCACAAAAABCCCBCCCCBCCABBAAAABCACCACBBB.exe" start= auto displayName= "UserDataSvc_CAAABACBBBACBCCBAACCBCBBACBBAACBCBCCBCCACBBACAAABBA"
                                                                                                                                              3⤵
                                                                                                                                              • Launches sc.exe
                                                                                                                                              PID:7384
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAABACBBBACBCCBAACCBCBBACBBAACBCBCCBCCACBBACAAABBA"
                                                                                                                                            2⤵
                                                                                                                                              PID:7924
                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                sc start "UserDataSvc_CAAABACBBBACBCCBAACCBCBBACBBAACBCBCCBCCACBBACAAABBA"
                                                                                                                                                3⤵
                                                                                                                                                  PID:7264
                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCABCBABCACCBCBACCBBCCACABACAABAAABACCBBBABBBCCAAABA.exe
                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCABCBABCACCBCBACCBBCCACABACAABAAABACCBBBABBBCCAAABA.exe
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1088
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAACACABBABBABBCCACBBCBBBBCBBBCCBBCCBACBBCBABCCCCBBCBCBAACACABBBBCCCBCCBAAACACABBBBBCAABBBBCCBBCCBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBAABABBBCBAAACCACCCACAACABBCCBCCACABCAAAAACBBACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                2⤵
                                                                                                                                                  PID:7676
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAACACABBABBABBCCACBBCBBBBCBBBCCBBCCBACBBCBABCCCCBBCBCBAACACABBBBCCCBCCBAAACACABBBBBCAABBBBCCBBCCBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBAABABBBCBAAACCACCCACAACABBCCBCCACABCAAAAACBBACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                    3⤵
                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                    PID:7000
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCABBAAACBCAACACCBCBCACBCBBCBCABCBBBBCCBBCAABCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBAABABBBCBAAACCACCCACAACABBCCBCCACABCAAAAACBBACAAC.exe" start= auto displayName= "UserDataSvc_ACCCABBAAACBCAACACCBCBCACBCBBCBCABCBBBBCCBBCAABCCCB"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:6732
                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                      sc create "UserDataSvc_ACCCABBAAACBCAACACCBCBCACBCBBCBCABCBBBBCCBBCAABCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBAABABBBCBAAACCACCCACAACABBCCBCCACABCAAAAACBBACAAC.exe" start= auto displayName= "UserDataSvc_ACCCABBAAACBCAACACCBCBCACBCBBCBCABCBBBBCCBBCAABCCCB"
                                                                                                                                                      3⤵
                                                                                                                                                      • Launches sc.exe
                                                                                                                                                      PID:2640
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCABBAAACBCAACACCBCBCACBCBBCBCABCBBBBCCBBCAABCCCB"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:8152
                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                        sc start "UserDataSvc_ACCCABBAAACBCAACACCBCBCACBCBBCBCABCBBBBCCBBCAABCCCB"
                                                                                                                                                        3⤵
                                                                                                                                                        • Launches sc.exe
                                                                                                                                                        PID:5944
                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBABCCACCABCACCCCABBBCABBBBABACBACABCBACCCCAAABBAB.exe
                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBABCCACCABCACCCCABBBCABBBBABACBACABCBACCCCAAABBAB.exe
                                                                                                                                                    1⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:5056
                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAABCACABACBBCBBACACBCCACABACABCBACACCACCAABBBAABABA.exe
                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAABCACABACBBCBBACACBCCACABACABCBACACCACCAABBBAABABA.exe
                                                                                                                                                    1⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:4740
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAAACAABBABCACBAAACACBCCACACCAACABAACBBABBCAAABABBBCBACABCACBCCCCBAAACACABCBCABCBAAACABABABACACCABBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAABCBABCBCBABBBCBAABBBAAACCCCCBBCBBCCABBBAACAACCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                      2⤵
                                                                                                                                                        PID:6204
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAAACAABBABCACBAAACACBCCACACCAACABAACBBABBCAAABABBBCBACABCACBCCCCBAAACACABCBCABCBAAACABABABACACCABBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAABCBABCBCBABBBCBAABBBAAACCCCCBBCBBCCABBBAACAACCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                          3⤵
                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                          PID:6448
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCBCCABABCABCAACCACACABCCCACAABCACBCBAABAACBBBBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAABCBABCBCBABBBCBAABBBAAACCCCCBBCBBCCABBBAACAACCAAA.exe" start= auto displayName= "UserDataSvc_BBCBCCABABCABCAACCACACABCCCACAABCACBCBAABAACBBBBCBA"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:6468
                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                            sc create "UserDataSvc_BBCBCCABABCABCAACCACACABCCCACAABCACBCBAABAACBBBBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAABCBABCBCBABBBCBAABBBAAACCCCCBBCBBCCABBBAACAACCAAA.exe" start= auto displayName= "UserDataSvc_BBCBCCABABCABCAACCACACABCCCACAABCACBCBAABAACBBBBCBA"
                                                                                                                                                            3⤵
                                                                                                                                                            • Launches sc.exe
                                                                                                                                                            PID:6760
                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBCCCCACBBBCABABCCAACCCBCACBCCBCCBACAAACBBACABBBCAAA.exe
                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBCCCCACBBBCABABCCAACCCBCACBCCBCCBACAAACBBACABBBCAAA.exe
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:3876
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAACCBABBCBCBCCBCBBCAAACBACABBCCCABCBCCACABBBBBCACBAABBBABBABCCBBBACABBCCBBBCBAACCBCCAABAACBBBABBABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACACCCBACCCBBCBBCACCABCAAABBCABBCCBAABBBCCCABBAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                          2⤵
                                                                                                                                                            PID:6444
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAACCBABBCBCBCCBCBBCAAACBACABBCCCABCBCCACABBBBBCACBAABBBABBABCCBBBACABBCCBBBCBAACCBCCAABAACBBBABBABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACACCCBACCCBBCBBCACCABCAAABBCABBCCBAABBBCCCABBAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                              3⤵
                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                              PID:6036
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCBACACBAABCBCBCBABBACCBACBBACBAAAABCCBCBBCCBBBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACACCCBACCCBBCBBCACCABCAAABBCABBCCBAABBBCCCABBAACC.exe" start= auto displayName= "UserDataSvc_BBCBACACBAABCBCBCBABBACCBACBBACBAAAABCCBCBBCCBBBACA"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:6976
                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                sc create "UserDataSvc_BBCBACACBAABCBCBCBABBACCBACBBACBAAAABCCBCBBCCBBBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACACCCBACCCBBCBBCACCABCAAABBCABBCCBAABBBCCCABBAACC.exe" start= auto displayName= "UserDataSvc_BBCBACACBAABCBCBCBABBACCBACBBACBAAAABCCBCBBCCBBBACA"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:7016
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCBACACBAABCBCBCBABBACCBACBBACBAAAABCCBCBBCCBBBACA"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:6860
                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                    sc start "UserDataSvc_BBCBACACBAABCBCBCBABBACCBACBBACBAAAABCCBCBBCCBBBACA"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:6736
                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCACAACCABAAAAACBCBCBABCBCACACBACBBABBCCCBACABBCBAC.exe
                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCCACAACCABAAAAACBCBCBABCBCACACBACBBABBCCCBACABBCBAC.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:6944
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBCABCBBACACCCACBBBBCCCAABABBCCBAACCAACCAACAAABBCBABBCAACACCBBBCCBACAAACABCCCCABBBACAABCBBCAACBAAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAACCACBCCCCACBACCCABCCBCCBABAAACBCBCCCAAACBCACCBBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:6432
                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBCABCBBACACCCACBBBBCCCAABABBCCBAACCAACCAACAAABBCBABBCAACACCBBBCCBACAAACABCCCCABBBACAABCBBCAACBAAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAACCACBCCCCACBACCCABCCBCCBABAAACBCBCCCAAACBCACCBBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                        PID:6200
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABABBBCAACCCABBAAACCCBBCABCBABBBCCACCCACBBBAAAAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAACCACBCCCCACBACCCABCCBCCBABAAACBCBCCCAAACBCACCBBCAA.exe" start= auto displayName= "UserDataSvc_CABABBBCAACCCABBAAACCCBBCABCBABBBCCACCCACBBBAAAAAAB"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:6188
                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                          sc create "UserDataSvc_CABABBBCAACCCABBAAACCCBBCABCBABBBCCACCCACBBBAAAAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAACCACBCCCCACBACCCABCCBCCBABAAACBCBCCCAAACBCACCBBCAA.exe" start= auto displayName= "UserDataSvc_CABABBBCAACCCABBAAACCCBBCABCBABBBCCACCCACBBBAAAAAAB"
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:7064
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABABBBCAACCCABBAAACCCBBCABCBABBBCCACCCACBBBAAAAAAB"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:7096
                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                              sc start "UserDataSvc_CABABBBCAACCCABBAAACCCBBCABCBABBBCCACCCACBBBAAAAAAB"
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                              PID:7056
                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:6036
                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBBCACCCBCBBBAACCACBCCBAAACCBBBBCCACAACCAAAABCACBCC.exe
                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBBCACCCBCBBBAACCACBCCBAAACCBBBBCCACAACCAAAABCACBCC.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:6296
                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAABCBABCBCBABBBCBAABBBAAACCCCCBBCBBCCABBBAACAACCAAA.exe
                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAABCBABCBCBABBBCBAABBBAAACCCCCBBCBBCCABBBAACAACCAAA.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:7076
                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACBBACBBBCAAABACCACCCCACABBBCCCCBAACACCACABCCCBCBAC.exe
                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACBBACBBBCAAABACCACCCCACABBBCCCCBAACACCACABCCCBCBAC.exe
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:6764
                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABCBBCACCCAABCCCBAAACCACAABCABAACCBCBCCCBCAABCBABC.exe
                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABCBBCACCCAABCCCBAAACCACAABCABAACCBCBCCCBCAABCBABC.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:6272
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCBCBCBBBCCACBBCCCAACBBCBABBACBCCBBAABBCCBACBBCABCABCCBABBBBBBCBBABCBABACCBAAAACACABBACAAACAABCCBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACBCCCCABCABBACCCCCCACCCBBBBBBABCACCBBCACACCCBAABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:7216
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCBCBCBBBCCACBBCCCAACBBCBABBACBCCBBAABBCCBACBBCABCABCCBABBBBBBCBBABCBABACCBAAAACACABBACAAACAABCCBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACBCCCCABCABBACCCCCCACCCBBBBBBABCACCBBCACACCCBAABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                        PID:7908
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACCBCBAABACBABACACABABBABCBBAAACBBBCBAAAABCCABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACBCCCCABCABBACCCCCCACCCBBBBBBABCACCBBCACACCCBAABBA.exe" start= auto displayName= "UserDataSvc_BBACCBCBAABACBABACACABABBABCBBAAACBBBCBAAAABCCABBBB"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:572
                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                          sc create "UserDataSvc_BBACCBCBAABACBABACACABABBABCBBAAACBBBCBAAAABCCABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACBCCCCABCABBACCCCCCACCCBBBBBBABCACCBBCACACCCBAABBA.exe" start= auto displayName= "UserDataSvc_BBACCBCBAABACBABACACABABBABCBBAAACBBBCBAAAABCCABBBB"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:7392
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACCBCBAABACBABACACABABBABCBBAAACBBBCBAAAABCCABBBB"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1240
                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                              sc start "UserDataSvc_BBACCBCBAABACBABACACABABBABCBBAAACBBBCBAAAABCCABBBB"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:1788
                                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACBBACBBBCAAABACCACCCCACABBBCCCCBAACACCACABCCCBCBAC.exe
                                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABACBBACBBBCAAABACCACCCCACABBBCCCCBAACACCACABCCCBCBAC.exe
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:6836
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABAABCABBABCABBBACAAABACBBCCBABBAACAACCBCBACABBBBABACACABBBCBCABBACBACCCACBACBCBCBBCCCCBCBCCCCCACBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBCCCAAAACBCCCCABCACBCABABABABCAAACCCACACBCACBABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1684
                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABAABCABBABCABBBACAAABACBBCCBABBAACAACCBCBACABBBBABACACABBBCBCABBACBACCCACBACBCBCBBCCCCBCBCCCCCACBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBCCCAAAACBCCCCABCACBCABABABABCAAACCCACACBCACBABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                    PID:7988
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCACAABCBCBAACCACABABBABBAABCCABABCBAABCAABAABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBCCCAAAACBCCCCABCACBCABABABABCAAACCCACACBCACBABAA.exe" start= auto displayName= "UserDataSvc_BACCACAABCBCBAACCACABABBABBAABCCABABCBAABCAABAABBAC"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:4388
                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                      sc create "UserDataSvc_BACCACAABCBCBAACCACABABBABBAABCCABABCBAABCAABAABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBCCCAAAACBCCCCABCACBCABABABABCAAACCCACACBCACBABAA.exe" start= auto displayName= "UserDataSvc_BACCACAABCBCBAACCACABABBABBAABCCABABCBAABCAABAABBAC"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                      PID:1532
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCACAABCBCBAACCACABABBABBAABCCABABCBAABCAABAABBAC"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:2076
                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAAACABBBCACCCCBBABCABCCACBCBBBBBACCBBAACABBACABCACC.exe
                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAAACABBBCACCCCBBABCABCCACBCBBBBBACCBBAACABBACABCACC.exe
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:1736
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACAACABACBCBCABCCBCCCBACACBCBBACABBBAAABCCABBAABABCACBACCBBBACCBBABACCCABCCCCAABCABCBACBCCCBCCCCACCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBABBAAAABABACCAABCAABBACBABAABBBCABCACBCCBABACACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:2356
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACAACABACBCBCABCCBCCCBACACBCBBACABBBAAABCCABBAABABCACBACCBBBACCBBABACCCABCCCCAABCABCBACBCCCBCCCCACCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBABBAAAABABACCAABCAABBACBABAABBBCABCACBCCBABACACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                            PID:6036
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACCBABACAABBCAACCAAACACBBBBBCACBACCCCBBABBCBAAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBABBAAAABABACCAABCAABBACBABAABBBCABCACBCCBABACACCBA.exe" start= auto displayName= "UserDataSvc_BAACCBABACAABBCAACCAAACACBBBBBCACBACCCCBBABBCBAAABC"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:4128
                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                              sc create "UserDataSvc_BAACCBABACAABBCAACCAAACACBBBBBCACBACCCCBBABBCBAAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBABBAAAABABACCAABCAABBACBABAABBBCABCACBCCBABACACCBA.exe" start= auto displayName= "UserDataSvc_BAACCBABACAABBCAACCAAACACBBBBBCACBACCCCBBABBCBAAABC"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:7592
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACCBABACAABBCAACCAAACACBBBBBCACBACCCCBBABBCBAAABC"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:8008
                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                  sc start "UserDataSvc_BAACCBABACAABBCAACCAAACACBBBBBCACBACCCCBBABBCBAAABC"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                  PID:7484
                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABCBBCACCCAABCCCBAAACCACAABCABAACCBCBCCCBCAABCBABC.exe
                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABCBBCACCCAABCCCBAAACCACAABCABAACCBCBCCCBCAABCBABC.exe
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:6276
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAACACABBABBABBCCACBBCBBBBCBBBCCBBCCBACBBCBABCCCCBBCBCBAACACABBBBCCCBCCBAAACACABBBBBCAABBBBCCBBCCBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABACCCBCCCCBBABACBABCBCABBABBABCBBCCAABBCABCCBABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:7652
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAACACABBABBABBCCACBBCBBBBCBBBCCBBCCBACBBCBABCCCCBBCBCBAACACABBBBCCCBCCBAAACACABBBBBCAABBBBCCBBCCBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABACCCBCCCCBBABACBABCBCABBABBABCBBCCAABBCABCCBABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                      PID:7176
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBCBCBCBCBACACCABCCBCCBCCCCBBACABCCBABCACACBACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABACCCBCCCCBBABACBABCBCABBABBABCBBCCAABBCABCCBABCAB.exe" start= auto displayName= "UserDataSvc_BACBCBCBCBCBACACCABCCBCCBCCCCBBACABCCBABCACACBACBAB"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:3388
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                        sc create "UserDataSvc_BACBCBCBCBCBACACCABCCBCCBCCCCBBACABCCBABCACACBACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABACCCBCCCCBBABACBABCBCABBABBABCBBCCAABBCABCCBABCAB.exe" start= auto displayName= "UserDataSvc_BACBCBCBCBCBACACCABCCBCCBCCCCBBACABCCBABCACACBACBAB"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                        PID:7660
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBCBCBCBCBACACCABCCBCCBCCCCBBACABCCBABCACACBACBAB"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:1304
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                          sc start "UserDataSvc_BACBCBCBCBCBACACCABCCBCCBCCCCBBACABCCBABCACACBACBAB"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                          PID:7824
                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACACCCBACCCBBCBBCACCABCAAABBCABBCCBAABBBCCCABBAACC.exe
                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACACCCBACCCBBCBBCACCABCAAABBCABBCCBAABBBCCCABBAACC.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:6208
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAABAAABCBCCBBCCAAACCCBBACAAABCCBBABACACCABCCABBCCABACABBACBCAABBBCCBBBCBCCBACCCCBACBACCBAABABBBCBCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBABCAAAAABCCCACCBCCBBCACABBBBABCCCBCBBBCCCCBBCBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:2668
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAABAAABCBCCBBCCAAACCCBBACAAABCCBBABACACCABCCABBCCABACABBACBCAABBBCCBBBCBCCBACCCCBACBACCBAABABBBCBCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBABCAAAAABCCCACCBCCBBCACABBBBABCCCBCBBBCCCCBBCBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                              PID:6332
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCAABAABBAABAAACCBCCBBCABBAAACBCBCCCCCABACCCBBCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBABCAAAAABCCCACCBCCBBCACABBBBABCCCBCBBBCCCCBBCBACB.exe" start= auto displayName= "UserDataSvc_BBCAABAABBAABAAACCBCCBBCABBAAACBCBCCCCCABACCCBBCABB"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:5352
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                sc create "UserDataSvc_BBCAABAABBAABAAACCBCCBBCABBAAACBCBCCCCCABACCCBBCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBABCAAAAABCCCACCBCCBBCACABBBBABCCCBCBBBCCCCBBCBACB.exe" start= auto displayName= "UserDataSvc_BBCAABAABBAABAAACCBCCBBCABBAAACBCBCCCCCABACCCBBCABB"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:5628
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCAABAABBAABAAACCBCCBBCABBAAACBCBCCCCCABACCCBBCABB"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:8184
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                    sc start "UserDataSvc_BBCAABAABBAABAAACCBCCBBCABBAAACBCBCCCCCABACCCBBCABB"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                    PID:1932
                                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAAACABBBCACCCCBBABCABCCACBCBBBBBACCBBAACABBACABCACC.exe
                                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAAACABBBCACCCCBBABCABCCACBCBBBBBACCBBAACABBACABCACC.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:6492
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABACCCCCBBCCBABABCCABCCCCBAABCBCCAAABBACCCAAACBBBBACCCABBBCCBCBCACBBCCAAAAACBBBBAAAAAACACCCBCBABAAAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABAABAAABBCBBBBBCCAABBBACAACBBBCACCABCBAACABBBBCCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:796
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABACCCCCBBCCBABABCCABCCCCBAABCBCCAAABBACCCAAACBBBBACCCABBBCCBCBCACBBCCAAAAACBBBBAAAAAACACCCBCBABAAAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABAABAAABBCBBBBBCCAABBBACAACBBBCACCABCBAACABBBBCCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                        PID:8180
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABBBAABBBAAACCACCAABACBABAACBAACABAACBABBBCCCCCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABAABAAABBCBBBBBCCAABBBACAACBBBCACCABCBAACABBBBCCCAB.exe" start= auto displayName= "UserDataSvc_BABBBAABBBAAACCACCAABACBABAACBAACABAACBABBBCCCCCABA"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:5688
                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBACBBABBAAAAACAACCBACACAACBCACABCCCAABABCBBCACCBCCB.exe
                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBACBBABBAAAAACAACCBACACAACBCACABCCCAABABCBBCACCBCCB.exe
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:3256
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBBAABBBCCCAABACBBBCACACBABBABBCABABABBBBABAACBCCCACCCBBCBAAABACABACACBCCABBCABBBABBCBCBCBABACACAACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAACACBACABAAABABCCABCBBABBBABABACABBCABCAACBABBBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:476
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                              schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBBAABBBCCCAABACBBBCACACBABBABBCABABABBBBABAACBCCCACCCBBCBAAABACABACACBCCABBCABBBABBCBCBCBABACACAACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAACACBACABAAABABCCABCBBABBBABABACABBCABCAACBABBBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                              PID:2320
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABAAAABACBCACCABAACABBCBCCBABBABCACCBBBBAAAAACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAACACBACABAAABABCCABCBBABBBABABACABBCABCAACBABBBCBA.exe" start= auto displayName= "UserDataSvc_CCABAAAABACBCACCABAACABBCBCCBABBABCACCBBBBAAAAACBCA"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:3736
                                                                                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACACCCBACCCBBCBBCACCABCAAABBCABBCCBAABBBCCCABBAACC.exe
                                                                                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACACCCBACCCBBCBBCACCABCAAABBCABBCCBAABBBCCCABBAACC.exe
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:6240
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCBACCCCAABCACACACBABBACBCCBBCABCBCBBBBCBCBBBCBCBBBCCACBBBBBABBACAAACCBBAAAACBAABBCCBBBCBCBBBBBACCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBCABACBCBCABABCCBBCCBBABBBCAAACCABCCABACABBCBCCCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:4440
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCBACCCCAABCACACACBABBACBCCBBCABCBCBBBBCBCBBBCBCBBBCCACBBBBBABBACAAACCBBAAAACBAABBCCBBBCBCBBBBBACCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBCABACBCBCABABCCBBCCBBABBBCAAACCABCCABACABBCBCCCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                    PID:7432
                                                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBACBBABBAAAAACAACCBACACAACBCACABCCCAABABCBBCACCBCCB.exe
                                                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBACBBABBAAAAACAACCBACACAACBCACABCCCAABABCBBCACCBCCB.exe
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:7068
                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAACCACBCCCCACBACCCABCCBCCBABAAACBCBCCCAAACBCACCBBCAA.exe
                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAACCACBCCCCACBACCCABCCBCCBABAAACBCBCCCAAACBCACCBBCAA.exe
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:6308
                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAACCACBCCCCACBACCCABCCBCCBABAAACBCBCCCAAACBCACCBBCAA.exe
                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAACCACBCCCCACBACCCABCCBCCBABAAACBCBCCCAAACBCACCBBCAA.exe
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:7008
                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBACCBABACBBAAAAACABABACBCCBABABACBBACBBBABBAABBAAB.exe
                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBACCBABACBBAAAAACABABACBCCBABABACBBACBBBABBAABBAAB.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:7704
                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBABBAAAABABACCAABCAABBACBABAABBBCABCACBCCBABACACCBA.exe
                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBABBAAAABABACCAABCAABBACBABAABBBCABCACBCCBABACACCBA.exe
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:8088
                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBABBAAAABABACCAABCAABBACBABAABBBCABCACBCCBABACACCBA.exe
                                                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBABBAAAABABACCAABCAABBACBABAABBBCABCACBCCBABACACCBA.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:6696
                                                                                                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACBCCCCABCABBACCCCCCACCCBBBBBBABCACCBBCACACCCBAABBA.exe
                                                                                                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACBCCCCABCABBACCCCCCACCCBBBBBBABCACCBBCACACCCBAABBA.exe
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:4792
                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBACCBABACBBAAAAACABABACBCCBABABACBBACBBBABBAABBAAB.exe
                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBACCBABACBBAAAAACABABACBCCBABABACBBACBBBABBAABBAAB.exe
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:5372
                                                                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBABCAAAAABCCCACCBCCBBCACABBBBABCCCBCBBBCCCCBBCBACB.exe
                                                                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBABCAAAAABCCCACCBCCBBCACABBBBABCCCBCBBBCCCCBBCBACB.exe
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:7628
                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBAABABBBCBAAACCACCCACAACABBCCBCCACABCAAAAACBBACAAC.exe
                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBAABABBBCBAAACCACCCACAACABBCCBCCACABCAAAAACBBACAAC.exe
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:7036
                                                                                                                                                                                                                                                                  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBCABBAACACABBCCACAAAAABCCCBCCCCBCCABBAAAABCACCACBBB.exe
                                                                                                                                                                                                                                                                    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBCABBAACACABBCCACAAAAABCCCBCCCCBCCABBAAAABCACCACBBB.exe
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:1228
                                                                                                                                                                                                                                                                    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACBCCCCABCABBACCCCCCACCCBBBBBBABCACCBBCACACCCBAABBA.exe
                                                                                                                                                                                                                                                                      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACBCCCCABCABBACCCCCCACCCBBBBBBABCACCBBCACACCCBAABBA.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:7560
                                                                                                                                                                                                                                                                      • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBCABBAACACABBCCACAAAAABCCCBCCCCBCCABBAAAABCACCACBBB.exe
                                                                                                                                                                                                                                                                        C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBCABBAACACABBCCACAAAAABCCCBCCCCBCCABBAAAABCACCACBBB.exe
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:3156
                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABACCCBCCCCBBABACBABCBCABBABBABCBBCCAABBCABCCBABCAB.exe
                                                                                                                                                                                                                                                                          C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABACCCBCCCCBBABACBABCBCABBABBABCBBCCAABBCABCCBABCAB.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:7340
                                                                                                                                                                                                                                                                          • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABACCCBCCCCBBABACBABCBCABBABBABCBBCCAABBCABCCBABCAB.exe
                                                                                                                                                                                                                                                                            C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABACCCBCCCCBBABACBABCBCABBABBABCBBCCAABBCABCCBABCAB.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:7968
                                                                                                                                                                                                                                                                            • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBAABABBBCBAAACCACCCACAACABBCCBCCACABCAAAAACBBACAAC.exe
                                                                                                                                                                                                                                                                              C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBAABABBBCBAAACCACCCACAACABBCCBCCACABCAAAAACBBACAAC.exe
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:5976
                                                                                                                                                                                                                                                                              • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBCCCAAAACBCCCCABCACBCABABABABCAAACCCACACBCACBABAA.exe
                                                                                                                                                                                                                                                                                C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBCCCAAAACBCCCCABCACBCABABABABCAAACCCACACBCACBABAA.exe
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:7400
                                                                                                                                                                                                                                                                                • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBABCAAAAABCCCACCBCCBBCACABBBBABCCCBCBBBCCCCBBCBACB.exe
                                                                                                                                                                                                                                                                                  C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBABCAAAAABCCCACCBCCBBCACABBBBABCCCBCBBBCCCCBBCBACB.exe
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:616

                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                                                                        Scheduled Task

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1053.005

                                                                                                                                                                                                                                                                                        System Services

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1569

                                                                                                                                                                                                                                                                                        Service Execution

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1569.002

                                                                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                                                                        Scheduled Task

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1053.005

                                                                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                                                                        Scheduled Task

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1053.005

                                                                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                                                                        System Location Discovery

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1614

                                                                                                                                                                                                                                                                                        System Language Discovery

                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                        T1614.001

                                                                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\7-Zip\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 9abcd0008c91573efd6650142d0209e9242eadf7a1f24d0ff0a0fa37872dc349
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        appvcleaner.exe
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                                                                                                                                                                                                                                                                                        • Size 14.0MB
                                                                                                                                                                                                                                                                                        • SHA256 242ba1737f8035c93157ffcfbfa0e3f04d965466eab155886e21e45ebf77f52c
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Common Files\microsoft shared\ink\as-IN\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 8877431f85386c3a4d8a8701a0f09b733addc3716079d7441010140a94cc79c4
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Common Files\microsoft shared\ink\ug-CN\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 80c37172c1bdcf0b65726cc2a1c23c0a63575b8269c15a912b95126cd14ac4a4
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 1a1f7c032090f0b4eee169798a2cc4171485c69cb6acbb21a44d3fc218590aee
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 3116cf5fed6ac9b3232cc1ea20617404d6e7ebd8a7674cdbcc7998af9d02e3bf
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Java\jdk-1.8\jre\bin\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 6e303eeb21a4b6be0c328e767e7900802ee294c34346b7a06bb0890d870269e8
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Java\jdk-1.8\jre\legal\javafx\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 c64176fc5f8ed32d88f2c8e7a4a4fd75278f29f12bacf8d27369957ad43fbc6c
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Java\jdk-1.8\jre\legal\jdk\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 441f838af1939a588559fbd5c0fcbd93a2e16d828dd4fac075223628d2aac58c
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Java\jre-1.8\legal\jdk\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 14dbe599f8d6383e7b7d42ebe9b2cda7e788c40fb169bf9b5f5176ff2acc2696
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Microsoft Office\root\Licenses16\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 cd310d558b856e44eeeb831d5bc3ac664962c9bd3344d2e9f808e5bfbcc26f79
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 c88eff53a0b319d3781a93a8db3a942cac5731ac304a383a675546f4514c3ca3
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 11095472e77441e084ed2a604ebd2329e33b09a5f43127ce16866cff40575c70
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Microsoft Office\root\Office16\FPA_f3\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 236a7e716a4757ee5fbb1e964b6476383814d6fefbc653667577e809cf310c5d
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 4a9069c3fbaa20be0b109da0c56450824ba035638171ae30302f1550ab9dfc0f
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 ef777a344dc425c478e5b992c1cee67e4d35e599712b3b271c3e36586dcf18bf
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Microsoft Office\root\Office16\sdxs\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 d4d1456338f4d733ae2209800697a231c7fb6b65ad8e6f63a8f405ddbbd560c1
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Microsoft Office\root\Stationery\1033\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 378153e7211d5b740e75579f6b90b5e9a1642eca8044e026c0968fd87f16266d
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 2be6c299d2f1db3dfd9d6b86e04d689eb8f7b2568747fe675472754bc728abd9
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 5680bcb42724a1337f4696fc6c45d6d0c627af4c32f96717371c91e8684f652e
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 e77b4009e7a476cae6b5bdb824bff87cb2d8c3b3a707297555cba7801dab7827
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 dcd7a4ad26c35fd52ee52ec148515aa04e76d851af0c4d4a2e37620ebe5ffe9a
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                        • SHA256 60bd6fdc9ded5c24e0c44678d425bd108f4df8cac8a0945e95ba82b4be8cb512
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 9819337a957202fbcaa1c58ad22646927da26d1dbc8f3df34e6a2f41533c59fc
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 cc2901c164b87ce8163f57d34a65790d3ee9fdd646f2e7cd230898a093d119f8
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 f082e9ebe57bc135a42233ac941ccbba304c0e0aa22ed0b2cc1802ee3de5f907
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 2def3e0b070024d6461ab451333ca1fda652da821f50e1fd3459c80bc34e4dfc
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 c408751a1b2077a76adaa31e2ccc038cc23a93dffe2287378e0dfa478d9c1d7d
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 abf69699a5ebb605926ca6ae2f78a8312e5ec3fc0a70a003795bdd772646dc5b
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
                                                                                                                                                                                                                                                                                        • Size 10B
                                                                                                                                                                                                                                                                                        • SHA256 3385f41693537b40abdb3ea0e7fa1275985c50a26564fd266ef360087f9247af
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        svchost_ABAABBAABCCCBBCCAACACAACBBBACCBBCCCABABBABBBBACACBAAACC.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABBAABCCCBBCCAACACAACBBBACCBBCCCABABBABBBBACACBAAACC.exe
                                                                                                                                                                                                                                                                                        • Size 11.9MB
                                                                                                                                                                                                                                                                                        • SHA256 7cbd08964c78ef99bf8c6a73ce1ba86dbc46d6c51b1545f34009214e3a3b8f6f
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 5KB
                                                                                                                                                                                                                                                                                        • SHA256 2696d6660c717f29d1f9c024b330e6689e127b468dbba60471d42c6c89ada64c
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 5KB
                                                                                                                                                                                                                                                                                        • SHA256 105f53bb5efb5ad926ba0de031a1d2a884e8011ddf4cff34af60c1c3ef4156f9
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 5KB
                                                                                                                                                                                                                                                                                        • SHA256 2656c9a67b4f85480e479241ac3b6a53bbade63f656cf522100f417fce2a83c2
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 5KB
                                                                                                                                                                                                                                                                                        • SHA256 8687f33ce159c3ad9cc4bbb0f813e614511e1795a3e2a7498daf38592f63bc00
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                                                                                        • SHA256 dcba0f99c5fcbd2931f65d65c474f80d5d784304ae2ba51f872159a3d5a54e93
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                                                                                        • SHA256 8581110a23ce424795d9390007a9d8e4d4cc977bc4564e0e049f7819cd8b2c9d
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                                                                        • SHA256 2c5d6390989aef0aad8c0d2e067f47236b6be8f9fbabd9121454db7b7ab4674c
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 9KB
                                                                                                                                                                                                                                                                                        • SHA256 4bfd170c525b2c3fe45859204c7a5ea40df30a86d20bb371342ee568fe6fd8b6
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 10KB
                                                                                                                                                                                                                                                                                        • SHA256 be2636bf5c30ff21e4593e8857020bcf19b19613c3ca764d3e3cca09d6d41ea2
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 11KB
                                                                                                                                                                                                                                                                                        • SHA256 02ab9c6be8a89850f355ba27850cbfdb24824c6143e3014f234ebbdaac5c39ee
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 11KB
                                                                                                                                                                                                                                                                                        • SHA256 91f809747a69188373af23eb0e88a3bb8b37423be96429cad9c1d2b6503bc01e
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                        • SHA256 4b65ed4a7242d35b272fc69f6318198d3b4b73703b896de2961769a1c0954000
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                        • SHA256 1c899dadd84ed6463d5f00afe210f070229b850157ae602dbb4744266cf11021
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                        • SHA256 46a5eb70934e56c463a8db989caeb58d0c183ccae625c82fb72879983c932735
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                        • SHA256 434f9d764cf4d2d9d186a311f0ef567f5526bd8e3a12f276843dd2aa041b0a7e
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 13KB
                                                                                                                                                                                                                                                                                        • SHA256 46e9b17515f076276d1efdb4f9039ca76e8905544a9e19612d18731f0f8b001a
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                        • SHA256 59aa58812baa1c834c99a95aac46c137849a6caee6807ed4d6746695e1fcc959
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                                                                                                        • SHA256 493db84a0a39b2a5d1245d0affcbd07e49d02d3d710d6dee8e23ae336af3061f
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 15KB
                                                                                                                                                                                                                                                                                        • SHA256 8a5ec8e121ac4db759a500d53275883209d573b40599237f2ead8cd312aff29a
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 16KB
                                                                                                                                                                                                                                                                                        • SHA256 d562e9a1a238c8254e6aabecce88d7bf86c3efb4a3d350fb3470b9f653af0bc6
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 16KB
                                                                                                                                                                                                                                                                                        • SHA256 caf5250bad1712da22d2a5ea86ea5e08000d6139ac7d3a65ecd3ef0490bd3732
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 17KB
                                                                                                                                                                                                                                                                                        • SHA256 59e02a909281283778b8c4730929cace07763cf93b8936fc002cedf74253e2cf
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 17KB
                                                                                                                                                                                                                                                                                        • SHA256 6cecfabb773023676a03effa9d9e43926fe20fc24061adfa73645069dd021d4f
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 18KB
                                                                                                                                                                                                                                                                                        • SHA256 d91cff02680981cd985a02b9351bc7d80038c86370903c9eb46d82898a7ead0f
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                        • SHA256 bdc361ee2891c4201fac7f218794b2238bb420b15bb52225d784718c443d2234
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                        • SHA256 bc3155bd80eaeccb189f0ea689fedba10c1d1f7ebc5674f40cd933850448ddaf
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                        • SHA256 db16a6ed962e7e3e6003bc2b490bba6bb2d186cb6bd02162de3c8fbb5789a9a8
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                        • SHA256 140c765d60a5ce2234c5e3f4628bbe269741e28bbee405b675dc681322ab4821
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                        • SHA256 9c2d5d3a3f3e1687cec97ee0ddc7a95786478a7bbeb31e4f055953a11919a271
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                        • SHA256 39ed61f7771bfe6fdbe23683dc0cf873301b4799c5950063c5cacee31e537026
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                        • SHA256 34e6c18035886a77418b64733bb0fe841c8e8df30d7bdaaf4b159a1381cb93c5
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        virus_log.txt
                                                                                                                                                                                                                                                                                        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
                                                                                                                                                                                                                                                                                        • Size 5KB
                                                                                                                                                                                                                                                                                        • SHA256 a4bc2001b8eac7aab4e11a73095013c678877ba6ed03b38b89f037e95dd93ef1
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        memory/8-463-0x0000000000D90000-0x0000000000DB2000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/548-0-0x0000000000C70000-0x0000000000C92000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/548-13-0x0000000000C70000-0x0000000000C92000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/792-407-0x0000000000B50000-0x0000000000B72000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/792-345-0x0000000000B50000-0x0000000000B72000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1088-3605-0x00000000000F0000-0x0000000000112000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1220-293-0x0000000000B30000-0x0000000000B52000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1264-2482-0x0000000000960000-0x0000000000982000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1516-121-0x00000000002E0000-0x0000000000302000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1516-49-0x00000000002E0000-0x0000000000302000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1656-1208-0x0000000000940000-0x0000000000962000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2316-1321-0x0000000000710000-0x0000000000732000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2316-2598-0x0000000000710000-0x0000000000732000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2580-408-0x0000000000850000-0x0000000000872000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2756-1320-0x0000000000110000-0x0000000000132000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2756-472-0x0000000000110000-0x0000000000132000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2844-48-0x0000000000B70000-0x0000000000B92000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2844-119-0x0000000000B70000-0x0000000000B92000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2968-409-0x0000000000850000-0x0000000000872000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3136-2599-0x00000000005E0000-0x0000000000602000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3180-2662-0x0000000000260000-0x0000000000282000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3296-260-0x0000000000CE0000-0x0000000000D02000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3296-344-0x0000000000CE0000-0x0000000000D02000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3468-1209-0x0000000000940000-0x0000000000962000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3468-3576-0x0000000000940000-0x0000000000962000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3468-2540-0x0000000000940000-0x0000000000962000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3616-377-0x00000000005A0000-0x00000000005C2000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3676-326-0x0000000001000000-0x0000000001022000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3676-495-0x0000000001000000-0x0000000001022000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3684-498-0x0000000000BD0000-0x0000000000BF2000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3684-1469-0x0000000000BD0000-0x0000000000BF2000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3688-497-0x0000000001000000-0x0000000001022000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3688-327-0x0000000001000000-0x0000000001022000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3752-123-0x00000000002E0000-0x0000000000302000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3752-50-0x00000000002E0000-0x0000000000302000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3812-159-0x0000000000AD0000-0x0000000000AF2000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3812-227-0x0000000000AD0000-0x0000000000AF2000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3836-246-0x00000000000C0000-0x00000000000E2000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3876-3664-0x0000000000830000-0x0000000000852000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3904-2705-0x0000000000260000-0x0000000000282000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3944-46-0x0000000000F00000-0x0000000000F22000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3944-15-0x0000000000F00000-0x0000000000F22000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4052-228-0x0000000000AD0000-0x0000000000AF2000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4052-160-0x0000000000AD0000-0x0000000000AF2000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4152-2483-0x0000000000960000-0x0000000000982000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4404-45-0x0000000000F00000-0x0000000000F22000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4404-14-0x0000000000F00000-0x0000000000F22000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4716-226-0x0000000000960000-0x0000000000982000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4716-158-0x0000000000960000-0x0000000000982000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4740-3663-0x0000000000EF0000-0x0000000000F12000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4740-3697-0x0000000000EF0000-0x0000000000F12000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4920-379-0x0000000000CE0000-0x0000000000D02000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4984-156-0x0000000000190000-0x00000000001B2000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5008-471-0x0000000000110000-0x0000000000132000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5008-1319-0x0000000000110000-0x0000000000132000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5056-3662-0x0000000000330000-0x0000000000352000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5068-473-0x0000000000BD0000-0x0000000000BF2000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5068-1468-0x0000000000BD0000-0x0000000000BF2000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5496-188-0x00000000009A0000-0x00000000009C2000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5668-378-0x0000000000CE0000-0x0000000000D02000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5852-295-0x00000000007A0000-0x00000000007C2000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5980-2661-0x00000000005E0000-0x0000000000602000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6296-3700-0x0000000000870000-0x0000000000892000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6944-3699-0x0000000000090000-0x00000000000B2000-memory.dmp
                                                                                                                                                                                                                                                                                        Download