08d5960457d9cb6d825598adaa46586f42d08fd402bb2b75df44a9d12591971f

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kikikmoralibrary.exe
Size 1.3MB
Sample260803-phnvzayxev
SHA256 08d5960457d9cb6d825598adaa46586f42d08fd402bb2b75df44a9d12591971f
MD5 7291eba9be5278ba9fd88c6a0b23554a
SHA1 bf61bb822aade4da4b728b29a913b404ded64bbf
SHA512 e32bb36684138ac876740c640ac3410b2a2f307ef1e35865aaa1d09975904c133dc350fd7789d66726edd213287a2e98e6f238b6d1395a9a477c05463ed81a67
SSDEEP 12288:jpoM+OlaffBeuNE1xy57hG3O/VtyVQ18V//2Jg0CbQzR2g7yemsi1kU8Vf8Y:FZwG1xy7D1Uag0Cw7yem0
TLSH
T17555C8827654B14BE5632B3141E316E10AE6AFEB16B0D4405D8322ADD0727EB7CEDF4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\INF\\.NETFramework\\CORPerfMonSymbols.exe"	kikikmoralibrary.exe

Modifies Windows Firewall 2 TTPs 24 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4044	netsh.exe
3600	netsh.exe
5184	netsh.exe
3124	netsh.exe
3184	netsh.exe
4088	netsh.exe
2976	netsh.exe
5644	netsh.exe
3304	netsh.exe
4872	netsh.exe
1540	netsh.exe
3100	netsh.exe
3756	netsh.exe
2368	netsh.exe
2724	netsh.exe
5540	netsh.exe
1948	netsh.exe
2356	netsh.exe
5760	netsh.exe
5548	netsh.exe
1960	netsh.exe
5568	netsh.exe
3796	netsh.exe
5248	netsh.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
5852	mppr.exe
3624	RC_ConnectedAccount.exe
5960	SystemDiagnosticsHost.exe
2616	mppr.exe
3864	mppr.exe
928	mppr.exe

Loads dropped DLL 1 IoCs

pid	Process
2312	Process not Found

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\SystemDiagnosticsHost.exe	mppr.exe
File opened for modification	C:\Windows\SysWOW64\SystemDiagnosticsHost.exe	mppr.exe
File created	C:\Windows\SysWOW64\SystemDiagnosticsHost.exe	kikikmoralibrary.exe
File opened for modification	C:\Windows\SysWOW64\SystemDiagnosticsHost.exe	kikikmoralibrary.exe
File opened for modification	C:\Windows\SysWOW64\SystemDiagnosticsHost.exe	mppr.exe
File opened for modification	C:\Windows\SysWOW64\SystemDiagnosticsHost.exe	RC_ConnectedAccount.exe
File opened for modification	C:\Windows\SysWOW64\SystemDiagnosticsHost.exe	mppr.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File created	C:\Windows\INF\.NETFramework\CORPerfMonSymbols.exe	kikikmoralibrary.exe
File created	C:\Windows\INF\usbhub\usbperfsym.exe	kikikmoralibrary.exe
File opened for modification	C:\Windows\Media\msldriver.dll	kikikmoralibrary.exe
File opened for modification	C:\Windows\Media\mppr.exe	mppr.exe
File opened for modification	C:\Windows\Media\msldriver.dll	RC_ConnectedAccount.exe
File opened for modification	C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe	mppr.exe
File opened for modification	C:\Windows\INF\.NETFramework\CORPerfMonSymbols.exe	mppr.exe
File opened for modification	C:\Windows\Media\mppr.exe	RC_ConnectedAccount.exe
File opened for modification	C:\Windows\INF\usbhub\usbperfsym.exe	mppr.exe
File opened for modification	C:\Windows\Media\msldriver.dll	mppr.exe
File opened for modification	C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe	mppr.exe
File opened for modification	C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe	mppr.exe
File created	C:\Windows\Media\mppr.exe	kikikmoralibrary.exe
File opened for modification	C:\Windows\Media\mppr.exe	kikikmoralibrary.exe
File opened for modification	C:\Windows\INF\.NETFramework\CORPerfMonSymbols.exe	kikikmoralibrary.exe
File opened for modification	C:\Windows\INF\.NETFramework\CORPerfMonSymbols.exe	RC_ConnectedAccount.exe
File opened for modification	C:\Windows\INF\usbhub\usbperfsym.exe	RC_ConnectedAccount.exe
File opened for modification	C:\Windows\Media\msldriver.dll	mppr.exe
File opened for modification	C:\Windows\INF\usbhub\usbperfsym.exe	mppr.exe
File opened for modification	C:\Windows\Media\msldriver.dll	mppr.exe
File opened for modification	C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe	kikikmoralibrary.exe
File opened for modification	C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe	RC_ConnectedAccount.exe
File opened for modification	C:\Windows\Media\mppr.exe	mppr.exe
File opened for modification	C:\Windows\INF\usbhub\usbperfsym.exe	mppr.exe
File opened for modification	C:\Windows\INF\usbhub\usbperfsym.exe	mppr.exe
File opened for modification	C:\Windows\INF\.NETFramework\CORPerfMonSymbols.exe	mppr.exe
File created	C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe	kikikmoralibrary.exe
File opened for modification	C:\Windows\INF\usbhub\usbperfsym.exe	kikikmoralibrary.exe
File opened for modification	C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe	mppr.exe
File opened for modification	C:\Windows\INF\.NETFramework\CORPerfMonSymbols.exe	mppr.exe
File opened for modification	C:\Windows\INF\.NETFramework\CORPerfMonSymbols.exe	mppr.exe
File opened for modification	C:\Windows\Media\msldriver.dll	mppr.exe
File created	C:\Windows\Media\msldriver.dll	kikikmoralibrary.exe
File opened for modification	C:\Windows\Media\mppr.exe	mppr.exe
File opened for modification	C:\Windows\Media\mppr.exe	mppr.exe

Launches sc.exe 26 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2156	sc.exe
4172	sc.exe
1116	sc.exe
2272	sc.exe
4656	sc.exe
6000	sc.exe
1228	sc.exe
1288	sc.exe
3100	sc.exe
3944	sc.exe
1132	sc.exe
5672	sc.exe
4312	sc.exe
5612	sc.exe
5844	sc.exe
4888	sc.exe
5952	sc.exe
5164	sc.exe
3392	sc.exe
5824	sc.exe
1476	sc.exe
4292	sc.exe
5444	sc.exe
4392	sc.exe
1932	sc.exe
5700	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5324	cmd.exe
5668	cmd.exe
4552	cmd.exe
5964	cmd.exe
1132	cmd.exe
3900	cmd.exe
1288	cmd.exe
1096	cmd.exe
4112	cmd.exe
888	cmd.exe
4476	cmd.exe
5300	cmd.exe
5908	cmd.exe
5032	cmd.exe
5372	cmd.exe
792	cmd.exe
4572	cmd.exe
2772	cmd.exe
2360	cmd.exe
3752	cmd.exe
5232	cmd.exe
1120	cmd.exe
5848	cmd.exe
1664	cmd.exe
5304	cmd.exe
4092	cmd.exe
3772	cmd.exe
2992	cmd.exe
5108	cmd.exe
5272	cmd.exe
5604	cmd.exe
6056	cmd.exe
4744	cmd.exe
1104	cmd.exe
2936	cmd.exe
1204	cmd.exe
1304	cmd.exe
5756	cmd.exe
5772	cmd.exe
5800	cmd.exe
4872	cmd.exe
5384	cmd.exe
4568	cmd.exe
5664	cmd.exe
5696	cmd.exe
1240	cmd.exe
2624	cmd.exe
1800	cmd.exe
3188	cmd.exe
5444	cmd.exe
5008	cmd.exe
4416	cmd.exe
2932	cmd.exe
5484	cmd.exe
5828	cmd.exe
3212	cmd.exe
1184	cmd.exe
4100	cmd.exe
5052	cmd.exe
5708	cmd.exe
756	cmd.exe
5816	cmd.exe
720	cmd.exe
3676	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemDiagnosticsHost.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1336	timeout.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	SecurityHealthService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	SecurityHealthService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	SecurityHealthService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	SecurityHealthService.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WdMam	SecurityHealthService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WdMam\URL Protocol	SecurityHealthService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WdMam\Shell\Open\Command	SecurityHealthService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WdMam\Shell\Open\Command\ = "C:\\Windows\\System32\\SecurityHealthHost.exe %1"	SecurityHealthService.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4196	schtasks.exe
4824	schtasks.exe
5756	schtasks.exe
6064	schtasks.exe
3000	schtasks.exe
2176	schtasks.exe
4824	schtasks.exe
4088	schtasks.exe
1172	schtasks.exe
1032	schtasks.exe
4432	schtasks.exe
4808	schtasks.exe
3196	schtasks.exe
1032	schtasks.exe
808	schtasks.exe
2784	schtasks.exe
5684	schtasks.exe
4516	schtasks.exe
5292	schtasks.exe
5808	schtasks.exe
3756	schtasks.exe
5612	schtasks.exe
3820	schtasks.exe
3728	schtasks.exe
3688	schtasks.exe
772	schtasks.exe
3860	schtasks.exe
5652	schtasks.exe
5364	schtasks.exe
2008	schtasks.exe
4816	schtasks.exe
4552	schtasks.exe
5388	schtasks.exe
5868	schtasks.exe
1756	schtasks.exe
4508	schtasks.exe
4660	schtasks.exe
5204	schtasks.exe
3448	schtasks.exe
3300	schtasks.exe
4292	schtasks.exe
2568	schtasks.exe
1216	schtasks.exe
5236	schtasks.exe
5260	schtasks.exe
352	schtasks.exe
5572	schtasks.exe
5552	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5960	SystemDiagnosticsHost.exe
5960	SystemDiagnosticsHost.exe
5852	mppr.exe
5852	mppr.exe
5960	SystemDiagnosticsHost.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5960	SystemDiagnosticsHost.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5960	SystemDiagnosticsHost.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5960	SystemDiagnosticsHost.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5960	SystemDiagnosticsHost.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5960	SystemDiagnosticsHost.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5960	SystemDiagnosticsHost.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5960	SystemDiagnosticsHost.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe
5852	mppr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4496	kikikmoralibrary.exe
Token: SeDebugPrivilege	5960	SystemDiagnosticsHost.exe
Token: SeDebugPrivilege	5852	mppr.exe
Token: SeDebugPrivilege	3624	RC_ConnectedAccount.exe
Token: SeDebugPrivilege	2616	mppr.exe
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeDebugPrivilege	3864	mppr.exe
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	5128	SecurityHealthService.exe
Token: SeCreatePagefilePrivilege	5128	SecurityHealthService.exe
Token: SeSystemEnvironmentPrivilege	5128	SecurityHealthService.exe
Token: SeSystemEnvironmentPrivilege	5128	SecurityHealthService.exe
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeDebugPrivilege	928	mppr.exe
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found
Token: SeCreatePagefilePrivilege	2312	Process not Found
Token: SeShutdownPrivilege	2312	Process not Found

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2312	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 2320	4496	kikikmoralibrary.exe	91
PID 4496 wrote to memory of 1808	4496	kikikmoralibrary.exe	93
PID 4496 wrote to memory of 5232	4496	kikikmoralibrary.exe	95
PID 5232 wrote to memory of 2176	5232	cmd.exe	97
PID 4496 wrote to memory of 3676	4496	kikikmoralibrary.exe	98
PID 3676 wrote to memory of 4552	3676	cmd.exe	100
PID 4496 wrote to memory of 4112	4496	kikikmoralibrary.exe	101
PID 4112 wrote to memory of 5388	4112	cmd.exe	103
PID 4496 wrote to memory of 5108	4496	kikikmoralibrary.exe	106
PID 5108 wrote to memory of 3300	5108	cmd.exe	108
PID 4496 wrote to memory of 1120	4496	kikikmoralibrary.exe	109
PID 1120 wrote to memory of 1228	1120	cmd.exe	112
PID 4496 wrote to memory of 5272	4496	kikikmoralibrary.exe	114
PID 5272 wrote to memory of 1932	5272	cmd.exe	116
PID 4496 wrote to memory of 476	4496	kikikmoralibrary.exe	117
PID 476 wrote to memory of 1288	476	cmd.exe	119
PID 4496 wrote to memory of 5848	4496	kikikmoralibrary.exe	121
PID 5848 wrote to memory of 3100	5848	cmd.exe	123
PID 4496 wrote to memory of 3916	4496	kikikmoralibrary.exe	125
PID 3916 wrote to memory of 1960	3916	cmd.exe	127
PID 4496 wrote to memory of 5372	4496	kikikmoralibrary.exe	128
PID 5372 wrote to memory of 5568	5372	cmd.exe	130
PID 4496 wrote to memory of 2616	4496	kikikmoralibrary.exe	131
PID 4496 wrote to memory of 3616	4496	kikikmoralibrary.exe	132
PID 3616 wrote to memory of 1336	3616	cmd.exe	134
PID 5852 wrote to memory of 4200	5852	mppr.exe	135
PID 4200 wrote to memory of 2784	4200	cmd.exe	137
PID 5852 wrote to memory of 888	5852	mppr.exe	138
PID 888 wrote to memory of 352	888	cmd.exe	140
PID 3624 wrote to memory of 1304	3624	RC_ConnectedAccount.exe	141
PID 1304 wrote to memory of 4292	1304	cmd.exe	143
PID 5852 wrote to memory of 1664	5852	mppr.exe	144
PID 1664 wrote to memory of 3944	1664	cmd.exe	146
PID 3624 wrote to memory of 1532	3624	RC_ConnectedAccount.exe	147
PID 5852 wrote to memory of 5008	5852	mppr.exe	149
PID 1532 wrote to memory of 5868	1532	cmd.exe	151
PID 5008 wrote to memory of 3756	5008	cmd.exe	152
PID 3624 wrote to memory of 2584	3624	RC_ConnectedAccount.exe	153
PID 2584 wrote to memory of 1132	2584	cmd.exe	155
PID 3624 wrote to memory of 4472	3624	RC_ConnectedAccount.exe	156
PID 4472 wrote to memory of 4044	4472	cmd.exe	158
PID 3624 wrote to memory of 3864	3624	RC_ConnectedAccount.exe	160
PID 5852 wrote to memory of 4476	5852	mppr.exe	161
PID 4476 wrote to memory of 1756	4476	cmd.exe	163
PID 5852 wrote to memory of 792	5852	mppr.exe	164
PID 792 wrote to memory of 4508	792	cmd.exe	166
PID 2616 wrote to memory of 4568	2616	mppr.exe	167
PID 4568 wrote to memory of 4196	4568	cmd.exe	169
PID 5852 wrote to memory of 2340	5852	mppr.exe	170
PID 2340 wrote to memory of 5444	2340	cmd.exe	172
PID 2616 wrote to memory of 2652	2616	mppr.exe	173
PID 5852 wrote to memory of 5304	5852	mppr.exe	175
PID 2652 wrote to memory of 5684	2652	cmd.exe	177
PID 5304 wrote to memory of 3600	5304	cmd.exe	178
PID 2616 wrote to memory of 1288	2616	mppr.exe	179
PID 1288 wrote to memory of 5700	1288	cmd.exe	181
PID 2616 wrote to memory of 5604	2616	mppr.exe	182
PID 5604 wrote to memory of 2368	5604	cmd.exe	184
PID 5852 wrote to memory of 1096	5852	mppr.exe	186
PID 1096 wrote to memory of 4660	1096	cmd.exe	188
PID 5852 wrote to memory of 4416	5852	mppr.exe	189
PID 4416 wrote to memory of 4824	4416	cmd.exe	191
PID 5852 wrote to memory of 4092	5852	mppr.exe	192
PID 4092 wrote to memory of 5672	4092	cmd.exe	194

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\kikikmoralibrary.exe
"C:\Users\Admin\AppData\Local\Temp\kikikmoralibrary.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\obbvqcbf\obbvqcbf.cmdline"
  2⤵
  PID:2320
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\umr3e5ys\umr3e5ys.cmdline"
  2⤵
  PID:1808
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5232
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2176
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4552
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5388
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3300
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:1228
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc create "System Diagnostics Host" binPath= "C:\Windows\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5272
- - C:\Windows\system32\sc.exe
    sc create "System Diagnostics Host" binPath= "C:\Windows\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto
    3⤵
    - Launches sc.exe
    PID:1932
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc description "System Diagnostics Host" "Monitors and manages system diagnostic tasks." & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:476
- - C:\Windows\system32\sc.exe
    sc description "System Diagnostics Host" "Monitors and manages system diagnostic tasks."
    3⤵
    - Launches sc.exe
    PID:1288
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc start "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5848
- - C:\Windows\system32\sc.exe
    sc start "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:3100
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1960
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall add rule name="XCCProcess" dir=in action=allow program="C:\Windows\Media\mppr.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5372
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="XCCProcess" dir=in action=allow program="C:\Windows\Media\mppr.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5568
- C:\Windows\Media\mppr.exe
  "C:\Windows\Media\mppr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4196
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5684
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c sc query "System Diagnostics Host" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\system32\sc.exe
      sc query "System Diagnostics Host"
      4⤵
      Launches sc.exe
      PID:5700
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5604
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall show rule name="XCCProcess"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xnmsexjz.1wc.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Windows\system32\timeout.exe
    timeout 8
    3⤵
    - Delays execution with timeout.exe
    PID:1336

C:\Windows\Media\mppr.exe
C:\Windows\Media\mppr.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2784
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:888
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:352
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:3944
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3756
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1756
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4508
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:5444
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5304
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3600
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4660
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4824
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:5672
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  PID:5476
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4088
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:6056
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5204
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:5484
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5292
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:5300
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:4292
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  PID:3268
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2976
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:4572
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3448
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:5908
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3728
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  PID:1656
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:2156
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:4744
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3124
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:2772
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3196
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  PID:1960
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5808
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  PID:3708
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:6000
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  PID:4864
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5644
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:5664
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6064
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:5828
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1032
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  PID:3252
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:5612
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  PID:3312
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3796
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  PID:2780
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4824
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  PID:4404
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4088
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  PID:5028
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:4392
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:5696
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3304
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:5052
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3756
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  PID:6032
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2568
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:5756
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:5844
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:1104
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5248
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  PID:4044
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5572
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:5324
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1216
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:5708
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:4888
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:5772
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2724
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  PID:468
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3688
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  PID:5036
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1172
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:5668
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:5952
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  PID:1252
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5540
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  PID:3028
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:772
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:2360
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5236
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:2936
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:4172
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:4552
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4872
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:756
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1032
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  PID:1396
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5612
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  PID:4184
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:5164
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  PID:6044
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1948
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:2992
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4432
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:1240
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3820
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:2624
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:3392
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  PID:5100
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2356
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:5964
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:808
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:1204
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5260
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:1132
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:5824
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:4100
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3184
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:3752
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5652
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:5816
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5364
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:3900
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:2272
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:3188
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1540
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:5444
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4808
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  PID:1380
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2008
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  PID:5496
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:1476
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:5800
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3100
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:4872
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4816
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  PID:4640
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5552
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:5384
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:4656
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:720
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5548

C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe
C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4292
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5868
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:1132
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4044
- C:\Windows\Media\mppr.exe
  "C:\Windows\Media\mppr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3864
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
    3⤵
    - Executes a command shell one-liner
    PID:2932
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4516
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
    3⤵
    - Executes a command shell one-liner
    PID:1184
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5756
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c sc query "System Diagnostics Host" & exit
    3⤵
    PID:956
  - - C:\Windows\system32\sc.exe
      sc query "System Diagnostics Host"
      4⤵
      Launches sc.exe
      PID:4312
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
    3⤵
    - Executes a command shell one-liner
    PID:3772
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall show rule name="XCCProcess"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5184

C:\Windows\SysWOW64\SystemDiagnosticsHost.exe
C:\Windows\SysWOW64\SystemDiagnosticsHost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5960

C:\Windows\system32\SecurityHealthService.exe
C:\Windows\system32\SecurityHealthService.exe
1⤵
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5128

C:\Windows\Media\mppr.exe
"C:\Windows\Media\mppr.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:928
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:1800
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3000
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  PID:1408
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3860
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:5032
- - C:\Windows\System32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:1116
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:3212
- - C:\Windows\System32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TmpA86B.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpA86B.tmp
Size 1KB
SHA256 398a92c3c19080d163f59a637e98882232cb12a3bb81d5bf722bd2992c6182e2
MD5 d282f0bd3a2c02945430c9a623566a1f
SHA1 2f5a85e85271c3de2a6bfc181d91318dc9fb2bc4
SHA512 6df2dfde12c6b0c41a49526aeb92b9541161a5188db8fe204b758c0aeccbcb329e1f0d229302a6b50259a29d494d8ab8414d0e610b80a9bfbe3b11857b83cf04
TLSH
T1BA31E97C2793996392A99E9408FC43125E77C346DC2015FABE3117445694B8CEEADC61
MD5 SHA1 SHA512 TLSH

Submit Download

xnmsexjz.1wc.bat

Path C:\Users\Admin\AppData\Local\Temp\xnmsexjz.1wc.bat
Size 160B
SHA256 5d1f5386eed422a7f93c435a2e0fd7d23dd4ba6148f7c2dd45a51b617bcb7f8f
MD5 9ed1519e86c8100de13f9baf472623da
SHA1 0c9fe6d2855cdbd79fbccfc0eef8a0458c244053
SHA512 b625b521480c0dee320e0c5799deb5e46e7d64d3d04a6aff288984f390e4d5ca9d743797c299aafdee740d1ffb95d394927f232407f9f5942458a5b34c6bf35b
TLSH
T179C0800195C6C70705443413257544CD9127A8253E4B6F609254444C714185CE492785
MD5 SHA1 SHA512 TLSH

Submit Download

RC_ConnectedAccount.exe

Path C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe
Size 1.3MB
SHA256 08d5960457d9cb6d825598adaa46586f42d08fd402bb2b75df44a9d12591971f
MD5 7291eba9be5278ba9fd88c6a0b23554a
SHA1 bf61bb822aade4da4b728b29a913b404ded64bbf
SHA512 e32bb36684138ac876740c640ac3410b2a2f307ef1e35865aaa1d09975904c133dc350fd7789d66726edd213287a2e98e6f238b6d1395a9a477c05463ed81a67
SSDEEP 12288:jpoM+OlaffBeuNE1xy57hG3O/VtyVQ18V//2Jg0CbQzR2g7yemsi1kU8Vf8Y:FZwG1xy7D1Uag0Cw7yem0
TLSH
T17555C8827654B14BE5632B3141E316E10AE6AFEB16B0D4405D8322ADD0727EB7CEDF4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msldriver.dll

Path C:\Windows\Media\msldriver.dll
Size 159KB
SHA256 87335a3c7f3ad7284a11f18e02afb8b4435ea11a0c43488565f428b422e5a363
MD5 3dde5da705aa8ff971adac73db7df7a4
SHA1 0f629e18a94fcb0c45574d4c39b5dd7998f28c8f
SHA512 d7676374e9e427981d97a930327c51bb52f330353b80ea718c555deef7e56d84243e86d7343277bf4d633fb92fde00eee5f507318a4d883e9bb484ecc89c0020
SSDEEP 3072:zovJL1Hr4Pa5gmJu3XzLUjO0XOVTzWf+4c:EvvL4Pa5DJu3DKOKOVN
TLSH
T196F35A1773A500BBE5678278C8A31A02F7B2B8114721DBAF03A447766F277D19D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemDiagnosticsHost.exe

Path C:\Windows\SysWOW64\SystemDiagnosticsHost.exe
Size 18KB
SHA256 3e224d0a248d0fa20a5a1d2e23f077f315a9b8a9a139f70e31fc11f45b79f462
MD5 bd6b364e53440ab82796b36fedf03d14
SHA1 1ae02103d507e7a742ad3110b512757da14306f3
SHA512 f96a491eb84331a120f3d76056e61285d685a85a03e633fca7ee537b3485710a8ee69d77a84cf2d996b3247d0a419df636906fb1a9c429d264abcefc6980afd1
SSDEEP 192:TNcF5QDLWFjCzbQ/x+oJsdKLh3wLO+0EJyHB7wYKW9eeQ5MHzgWi0lnz2R:TNc3aWFOzb0x+zdA8UBmW9eeQ53ez2
TLSH
T1A282F6226FD44065F5B90A76C8E1E20356B06911DC63DF6E46C02E1FEC2199CAB3A7FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

obbvqcbf.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\obbvqcbf\obbvqcbf.0.cs
Size 1.8MB
SHA256 bf7d9ea8ac546c0f4f00b94fbd7e79c1829d24cc4e8382373c2a5bd2a505ed54
MD5 f9c22da8d85b0c15a3f28178e7e6fbb9
SHA1 2fd27b2244fe8d2d348089a32925951f75cbd3ef
SHA512 c9788773b9a319389a041c69720533952f7887cbfd63926e105dd209273c4def79563491ca879ce029bbfa7a17c568b660e573f2c352ee938f57dae1321893aa
SSDEEP 12288:6U/zUPtvksfgb3RCjp27i72Ocdj3Oo1WGqkpMYiEe3GNiFbzFzwUe8pqRfc4Uggv:6UwkMgdCjp2CDY/4vktiEe3GCsBKkk
TLSH
T1A0851B1EDCD56AFA1DA6445DF590A2FAC7E2B40DF152A01F8F7031A3D87A8D7B810B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

obbvqcbf.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\obbvqcbf\obbvqcbf.cmdline
Size 368B
SHA256 3f937877085d7584405aab041ab05c29030b8f81cee72d78ccf38b54d42619e2
MD5 9757b8bd33b83c7fe97eb881b3a7e53c
SHA1 d48ed6c879e3a8ae32d0730a2afed3304aee63e5
SHA512 23a212fcf2f4cda7184b96339fbab9b7d5b14880b0228895b2fdd52f6dd2465ad725320be1fbedd93e6ab9a2728a08162523acc117e7706be734e990abd04a47
TLSH
T1EEE0D83F4769C7BD4524610B41D5C8DC52F207172A4ABE98F1C10884423F5D8BAE4947
MD5 SHA1 SHA512 TLSH

Submit Download

umr3e5ys.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\umr3e5ys\umr3e5ys.0.cs
Size 1.8MB
SHA256 76f4248c5c3a7b4188a425b7abc67b3216e39a4e5aa20bbfb406ae14cb223cc1
MD5 4e2606e3874bfe5f9980b8dc08df5a94
SHA1 03c39d4a80122c2b389af4722accf9da2cc96b5f
SHA512 409b6c44e336153ac65877f2017fe8d6b7ba8ded88738981cae5e249abdf44a2caaddf899da8e4b1c9152918fadab567f79fcb6b0dc44869569f075154f778ae
SSDEEP 12288:m8Y4qQ//O+Uqu4yjCtHbR7irIHbw7k9aoSMe3zXrJK0KtS+VAU8UjU3ZeAMV8VLF:mx4qYO+u67MwCz3eLV8VLuU2g
TLSH
T1C385C388AA91760193D6E5EB43E1E9EA9C337537F54AED804C08667048772BFD94C3CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

umr3e5ys.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\umr3e5ys\umr3e5ys.cmdline
Size 368B
SHA256 f7c2f165e10c0bced9b2dad181043da71c8f1d8f743ab23f342108242c2cddde
MD5 75f71ce823df9e3c3133e74dc8d7ac50
SHA1 9212df0b6818be07654d176af89d2f69f7d62d9c
SHA512 b1329c0e4263f6b3fd644fb289c894b4b69bd961631ee20cf2d9b814eae884b5587134878ac155d275dae971d6a20f64e89d28b8dc0a236537ca3f33a956d261
TLSH
T13DE0D83F43A9C7BD5124550B11D5CADC56F2571F390ABED8E5C10854423F99473E0D46
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2312-124-0x0000000000D30000-0x0000000000D31000-memory.dmp

Download

memory/4496-23-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4496-4-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4496-0-0x00007FFB799CF000-0x00007FFB799D0000-memory.dmp

Download

memory/4496-20-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4496-6-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4496-30-0x000001E8E6400000-0x000001E8E6412000-memory.dmp

Download

memory/4496-5-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4496-22-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4496-91-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4496-1-0x000001E8E4590000-0x000001E8E46EA000-memory.dmp

Download

memory/4496-2-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4496-3-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4496-110-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5960-99-0x0000000003CF0000-0x0000000003D12000-memory.dmp

Download

memory/5960-98-0x00000000006E0000-0x00000000006EA000-memory.dmp

Download