f4fa98005152a0e34a1cd7a94cfd6cd7d173482727f63baee633be85566e5b80

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f4fa98005152a0e34a1cd7a94cfd6cd7d173482727f63baee633be85566e5b80.exe
Size 2.7MB
Sample260827-m5p1fagm21
SHA256 f4fa98005152a0e34a1cd7a94cfd6cd7d173482727f63baee633be85566e5b80
MD5 6588976c77720a97ee16c901a2c6c224
SHA1 14fc81a7079535a215ec36f089a25fd143c6caae
SHA512 4453470d16bbc7ff43a042fb5955e89d0fe6ae0e6c24c6986bb07d5074e94caa56d1ce7ca297418b6c6d940e2d838eb085654cc0737f08d3d783a75e1a4aae4b
SSDEEP 12288:pbK4IiVAItgGtec6oLuTHyaq3EMQjR8iJcgpu9aVY30GYi2+xe5ob0eaan0JYb5r:HtMcPmR8TEeaanwa
TLSH
T1F2D5F31935FB404B6C36AD581FD8E87FC93AF621161D347E1128868E8713B49DDBE0BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\INF\\.NETFramework\\CORPerfMonSymbols.exe"	tmp6ACB.tmp.exe

Modifies Windows Firewall 2 TTPs 27 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
852	netsh.exe
4552	netsh.exe
3792	netsh.exe
3572	netsh.exe
4160	netsh.exe
4140	netsh.exe
1048	netsh.exe
3424	netsh.exe
3152	netsh.exe
1960	netsh.exe
4988	netsh.exe
4292	netsh.exe
1632	netsh.exe
4624	netsh.exe
4544	netsh.exe
776	netsh.exe
4580	netsh.exe
4856	netsh.exe
2208	netsh.exe
4704	netsh.exe
2332	netsh.exe
4116	netsh.exe
1460	netsh.exe
5048	netsh.exe
464	netsh.exe
892	netsh.exe
4816	netsh.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	f4fa98005152a0e34a1cd7a94cfd6cd7d173482727f63baee633be85566e5b80.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	tmp6ACB.tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	RC_ConnectedAccount.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 8 IoCs

pid	Process
4980	tmp6ACB.tmp.exe
5068	mppr.exe
4280	SystemDiagnosticsHost.exe
3080	RC_ConnectedAccount.exe
4924	usbperfsym.exe
3288	mppr.exe
4864	mppr.exe
1512	mppr.exe

Loads dropped DLL 1 IoCs

pid	Process
3224	Process not Found

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\SystemDiagnosticsHost.exe	mppr.exe
File opened for modification	C:\Windows\SysWOW64\SystemDiagnosticsHost.exe	RC_ConnectedAccount.exe
File opened for modification	C:\Windows\SysWOW64\SystemDiagnosticsHost.exe	mppr.exe
File opened for modification	C:\Windows\SysWOW64\SystemDiagnosticsHost.exe	mppr.exe
File opened for modification	C:\Windows\SysWOW64\SystemDiagnosticsHost.exe	mppr.exe
File created	C:\Windows\SysWOW64\SystemDiagnosticsHost.exe	tmp6ACB.tmp.exe
File opened for modification	C:\Windows\SysWOW64\SystemDiagnosticsHost.exe	tmp6ACB.tmp.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\.NETFramework\CORPerfMonSymbols.exe	RC_ConnectedAccount.exe
File opened for modification	C:\Windows\Media\mppr.exe	mppr.exe
File opened for modification	C:\Windows\Media\mppr.exe	mppr.exe
File opened for modification	C:\Windows\INF\.NETFramework\CORPerfMonSymbols.exe	mppr.exe
File created	C:\Windows\INF\usbhub\usbperfsym.exe	tmp6ACB.tmp.exe
File opened for modification	C:\Windows\Media\mppr.exe	RC_ConnectedAccount.exe
File created	C:\Windows\Media\msldriver.dll	tmp6ACB.tmp.exe
File opened for modification	C:\Windows\Media\msldriver.dll	tmp6ACB.tmp.exe
File opened for modification	C:\Windows\INF\.NETFramework\CORPerfMonSymbols.exe	mppr.exe
File opened for modification	C:\Windows\INF\usbhub\usbperfsym.exe	mppr.exe
File opened for modification	C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe	RC_ConnectedAccount.exe
File opened for modification	C:\Windows\INF\usbhub\usbperfsym.exe	RC_ConnectedAccount.exe
File created	C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe	tmp6ACB.tmp.exe
File created	C:\Windows\INF\.NETFramework\CORPerfMonSymbols.exe	tmp6ACB.tmp.exe
File opened for modification	C:\Windows\INF\usbhub\usbperfsym.exe	tmp6ACB.tmp.exe
File opened for modification	C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe	mppr.exe
File opened for modification	C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe	mppr.exe
File opened for modification	C:\Windows\Media\msldriver.dll	mppr.exe
File opened for modification	C:\Windows\INF\usbhub\usbperfsym.exe	mppr.exe
File opened for modification	C:\Windows\Media\msldriver.dll	mppr.exe
File opened for modification	C:\Windows\Media\mppr.exe	tmp6ACB.tmp.exe
File opened for modification	C:\Windows\INF\.NETFramework\CORPerfMonSymbols.exe	mppr.exe
File opened for modification	C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe	mppr.exe
File opened for modification	C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe	mppr.exe
File opened for modification	C:\Windows\INF\.NETFramework\CORPerfMonSymbols.exe	mppr.exe
File created	C:\Windows\Media\mppr.exe	tmp6ACB.tmp.exe
File opened for modification	C:\Windows\INF\.NETFramework\CORPerfMonSymbols.exe	tmp6ACB.tmp.exe
File opened for modification	C:\Windows\Media\mppr.exe	mppr.exe
File opened for modification	C:\Windows\Media\msldriver.dll	RC_ConnectedAccount.exe
File opened for modification	C:\Windows\INF\usbhub\usbperfsym.exe	mppr.exe
File opened for modification	C:\Windows\Media\mppr.exe	mppr.exe
File opened for modification	C:\Windows\INF\usbhub\usbperfsym.exe	mppr.exe
File opened for modification	C:\Windows\Media\msldriver.dll	mppr.exe
File opened for modification	C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe	tmp6ACB.tmp.exe
File opened for modification	C:\Windows\Media\msldriver.dll	mppr.exe

Launches sc.exe 31 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4648	sc.exe
692	sc.exe
3064	sc.exe
3212	sc.exe
4492	sc.exe
1656	sc.exe
4928	sc.exe
2596	sc.exe
2832	sc.exe
1196	sc.exe
4444	sc.exe
2076	sc.exe
3804	sc.exe
3988	sc.exe
4140	sc.exe
4216	sc.exe
1068	sc.exe
2844	sc.exe
3164	sc.exe
1068	sc.exe
2332	sc.exe
1720	sc.exe
3992	sc.exe
4976	sc.exe
2844	sc.exe
1776	sc.exe
5004	sc.exe
3780	sc.exe
5048	sc.exe
1448	sc.exe
4460	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3564	cmd.exe
1068	cmd.exe
4928	cmd.exe
412	cmd.exe
2812	cmd.exe
3828	cmd.exe
5060	cmd.exe
5096	cmd.exe
1396	cmd.exe
640	cmd.exe
4320	cmd.exe
3784	cmd.exe
3524	cmd.exe
1424	cmd.exe
4972	cmd.exe
4876	cmd.exe
4992	cmd.exe
1624	cmd.exe
3792	cmd.exe
2016	cmd.exe
4204	cmd.exe
4476	cmd.exe
1248	cmd.exe
3168	cmd.exe
1944	cmd.exe
2364	cmd.exe
2468	cmd.exe
2788	cmd.exe
4756	cmd.exe
1440	cmd.exe
2596	cmd.exe
1792	cmd.exe
4388	cmd.exe
4236	cmd.exe
2648	cmd.exe
1796	cmd.exe
4036	cmd.exe
4688	cmd.exe
2516	cmd.exe
5076	cmd.exe
4488	cmd.exe
4948	cmd.exe
540	cmd.exe
1020	cmd.exe
4824	cmd.exe
3832	cmd.exe
4152	cmd.exe
1732	cmd.exe
4160	cmd.exe
3960	cmd.exe
4064	cmd.exe
2088	cmd.exe
2896	cmd.exe
3216	cmd.exe
2116	cmd.exe
1864	cmd.exe
2772	cmd.exe
3504	cmd.exe
2796	cmd.exe
1048	cmd.exe
1420	cmd.exe
2780	cmd.exe
2388	cmd.exe
1920	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemDiagnosticsHost.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1148	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3368	schtasks.exe
3716	schtasks.exe
4404	schtasks.exe
3152	schtasks.exe
4868	schtasks.exe
3108	schtasks.exe
4360	schtasks.exe
4196	schtasks.exe
4728	schtasks.exe
5092	schtasks.exe
2736	schtasks.exe
2332	schtasks.exe
3356	schtasks.exe
1628	schtasks.exe
2900	schtasks.exe
3424	schtasks.exe
3620	schtasks.exe
2840	schtasks.exe
4352	schtasks.exe
4324	schtasks.exe
4148	schtasks.exe
4832	schtasks.exe
4424	schtasks.exe
3788	schtasks.exe
4908	schtasks.exe
2096	schtasks.exe
3652	schtasks.exe
4328	schtasks.exe
2736	schtasks.exe
2512	schtasks.exe
1772	schtasks.exe
4880	schtasks.exe
2144	schtasks.exe
3712	schtasks.exe
4556	schtasks.exe
1888	schtasks.exe
2252	schtasks.exe
3372	schtasks.exe
1256	schtasks.exe
2140	schtasks.exe
1512	schtasks.exe
3620	schtasks.exe
4500	schtasks.exe
1144	schtasks.exe
2924	schtasks.exe
4504	schtasks.exe
4084	schtasks.exe
4968	schtasks.exe
2828	schtasks.exe
1780	schtasks.exe
4220	schtasks.exe
1960	schtasks.exe
4664	schtasks.exe
3164	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4280	SystemDiagnosticsHost.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
4280	SystemDiagnosticsHost.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
4280	SystemDiagnosticsHost.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
4280	SystemDiagnosticsHost.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
4280	SystemDiagnosticsHost.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
5068	mppr.exe
4280	SystemDiagnosticsHost.exe
5068	mppr.exe
5068	mppr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3224	Process not Found

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	tmp6ACB.tmp.exe
Token: SeDebugPrivilege	4280	SystemDiagnosticsHost.exe
Token: SeDebugPrivilege	5068	mppr.exe
Token: SeDebugPrivilege	3080	RC_ConnectedAccount.exe
Token: SeShutdownPrivilege	3224	Process not Found
Token: SeCreatePagefilePrivilege	3224	Process not Found
Token: SeShutdownPrivilege	3224	Process not Found
Token: SeCreatePagefilePrivilege	3224	Process not Found
Token: SeShutdownPrivilege	3224	Process not Found
Token: SeCreatePagefilePrivilege	3224	Process not Found
Token: SeShutdownPrivilege	3224	Process not Found
Token: SeCreatePagefilePrivilege	3224	Process not Found
Token: SeShutdownPrivilege	3224	Process not Found
Token: SeCreatePagefilePrivilege	3224	Process not Found
Token: SeDebugPrivilege	3288	mppr.exe
Token: SeShutdownPrivilege	3224	Process not Found
Token: SeCreatePagefilePrivilege	3224	Process not Found
Token: SeShutdownPrivilege	3224	Process not Found
Token: SeCreatePagefilePrivilege	3224	Process not Found
Token: SeShutdownPrivilege	3224	Process not Found
Token: SeCreatePagefilePrivilege	3224	Process not Found
Token: SeShutdownPrivilege	3224	Process not Found
Token: SeCreatePagefilePrivilege	3224	Process not Found
Token: SeShutdownPrivilege	3224	Process not Found
Token: SeCreatePagefilePrivilege	3224	Process not Found
Token: SeDebugPrivilege	4864	mppr.exe
Token: SeShutdownPrivilege	3224	Process not Found
Token: SeCreatePagefilePrivilege	3224	Process not Found
Token: SeShutdownPrivilege	3224	Process not Found
Token: SeCreatePagefilePrivilege	3224	Process not Found
Token: SeShutdownPrivilege	3224	Process not Found
Token: SeCreatePagefilePrivilege	3224	Process not Found
Token: SeShutdownPrivilege	3224	Process not Found
Token: SeCreatePagefilePrivilege	3224	Process not Found
Token: SeShutdownPrivilege	3224	Process not Found
Token: SeCreatePagefilePrivilege	3224	Process not Found
Token: SeDebugPrivilege	1512	mppr.exe
Token: SeShutdownPrivilege	3224	Process not Found
Token: SeCreatePagefilePrivilege	3224	Process not Found
Token: SeShutdownPrivilege	3224	Process not Found
Token: SeCreatePagefilePrivilege	3224	Process not Found
Token: SeShutdownPrivilege	3224	Process not Found
Token: SeCreatePagefilePrivilege	3224	Process not Found

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3224	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 4980	1788	f4fa98005152a0e34a1cd7a94cfd6cd7d173482727f63baee633be85566e5b80.exe	86
PID 4980 wrote to memory of 4480	4980	tmp6ACB.tmp.exe	89
PID 4480 wrote to memory of 3024	4480	csc.exe	91
PID 4980 wrote to memory of 3840	4980	tmp6ACB.tmp.exe	92
PID 3840 wrote to memory of 2620	3840	csc.exe	94
PID 4980 wrote to memory of 4488	4980	tmp6ACB.tmp.exe	96
PID 4488 wrote to memory of 3064	4488	cmd.exe	98
PID 4980 wrote to memory of 3216	4980	tmp6ACB.tmp.exe	99
PID 3216 wrote to memory of 3988	3216	cmd.exe	101
PID 4980 wrote to memory of 3564	4980	tmp6ACB.tmp.exe	102
PID 3564 wrote to memory of 4504	3564	cmd.exe	104
PID 4980 wrote to memory of 3960	4980	tmp6ACB.tmp.exe	105
PID 3960 wrote to memory of 1144	3960	cmd.exe	107
PID 4980 wrote to memory of 2648	4980	tmp6ACB.tmp.exe	109
PID 2648 wrote to memory of 4148	2648	cmd.exe	111
PID 4980 wrote to memory of 2116	4980	tmp6ACB.tmp.exe	112
PID 2116 wrote to memory of 2252	2116	cmd.exe	115
PID 4980 wrote to memory of 4052	4980	tmp6ACB.tmp.exe	116
PID 4052 wrote to memory of 3212	4052	cmd.exe	118
PID 4980 wrote to memory of 2632	4980	tmp6ACB.tmp.exe	119
PID 2632 wrote to memory of 4444	2632	cmd.exe	121
PID 4980 wrote to memory of 4224	4980	tmp6ACB.tmp.exe	122
PID 4224 wrote to memory of 2076	4224	cmd.exe	124
PID 4980 wrote to memory of 412	4980	tmp6ACB.tmp.exe	125
PID 412 wrote to memory of 4492	412	cmd.exe	127
PID 4980 wrote to memory of 1796	4980	tmp6ACB.tmp.exe	129
PID 1796 wrote to memory of 4544	1796	cmd.exe	131
PID 4980 wrote to memory of 4848	4980	tmp6ACB.tmp.exe	136
PID 4848 wrote to memory of 892	4848	cmd.exe	138
PID 4980 wrote to memory of 3288	4980	tmp6ACB.tmp.exe	139
PID 4980 wrote to memory of 3168	4980	tmp6ACB.tmp.exe	140
PID 3168 wrote to memory of 1148	3168	cmd.exe	142
PID 5068 wrote to memory of 4756	5068	mppr.exe	143
PID 4756 wrote to memory of 3356	4756	cmd.exe	145
PID 5068 wrote to memory of 3740	5068	mppr.exe	146
PID 3740 wrote to memory of 4084	3740	cmd.exe	148
PID 5068 wrote to memory of 988	5068	mppr.exe	149
PID 988 wrote to memory of 3780	988	cmd.exe	151
PID 5068 wrote to memory of 4204	5068	mppr.exe	152
PID 4204 wrote to memory of 4816	4204	cmd.exe	154
PID 5068 wrote to memory of 2780	5068	mppr.exe	156
PID 2780 wrote to memory of 1628	2780	cmd.exe	158
PID 5068 wrote to memory of 3112	5068	mppr.exe	159
PID 3112 wrote to memory of 2900	3112	cmd.exe	161
PID 5068 wrote to memory of 2080	5068	mppr.exe	162
PID 2080 wrote to memory of 4648	2080	cmd.exe	164
PID 3080 wrote to memory of 4960	3080	RC_ConnectedAccount.exe	165
PID 5068 wrote to memory of 4444	5068	mppr.exe	167
PID 4960 wrote to memory of 3372	4960	cmd.exe	169
PID 4444 wrote to memory of 4704	4444	cmd.exe	170
PID 3080 wrote to memory of 1396	3080	RC_ConnectedAccount.exe	171
PID 1396 wrote to memory of 4968	1396	cmd.exe	173
PID 3080 wrote to memory of 1984	3080	RC_ConnectedAccount.exe	174
PID 1984 wrote to memory of 2596	1984	cmd.exe	176
PID 3080 wrote to memory of 4824	3080	RC_ConnectedAccount.exe	177
PID 4824 wrote to memory of 852	4824	cmd.exe	179
PID 3080 wrote to memory of 4864	3080	RC_ConnectedAccount.exe	180
PID 3288 wrote to memory of 4036	3288	mppr.exe	183
PID 4036 wrote to memory of 4728	4036	cmd.exe	185
PID 3288 wrote to memory of 4540	3288	mppr.exe	186
PID 4540 wrote to memory of 4832	4540	cmd.exe	188
PID 3288 wrote to memory of 5000	3288	mppr.exe	189
PID 5000 wrote to memory of 4976	5000	cmd.exe	191
PID 3288 wrote to memory of 4972	3288	mppr.exe	192

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f4fa98005152a0e34a1cd7a94cfd6cd7d173482727f63baee633be85566e5b80.exe
"C:\Users\Admin\AppData\Local\Temp\f4fa98005152a0e34a1cd7a94cfd6cd7d173482727f63baee633be85566e5b80.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\tmp6ACB.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp6ACB.tmp.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4zok3yyy\4zok3yyy.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES915E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC512C5C904ADE4C92B34D8172C88FE42E.TMP"
      4⤵
      PID:3024
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oznuhmx4\oznuhmx4.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES93A0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC277FB8E75A564FC289267EF9B5A9BBE0.TMP"
      4⤵
      PID:2620
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c sc.exe create aswArPot.sys binPath= C:\windows\temp\aswArPot.bin type= kernel & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Windows\system32\sc.exe
      sc.exe create aswArPot.sys binPath= C:\windows\temp\aswArPot.bin type= kernel
      4⤵
      Launches sc.exe
      PID:3064
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c sc.exe start aswArPot.sys & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - C:\Windows\system32\sc.exe
      sc.exe start aswArPot.sys
      4⤵
      Launches sc.exe
      PID:3988
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4504
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1144
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4148
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2252
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c sc query "System Diagnostics Host" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4052
  - - C:\Windows\system32\sc.exe
      sc query "System Diagnostics Host"
      4⤵
      Launches sc.exe
      PID:3212
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c sc create "System Diagnostics Host" binPath= "C:\Windows\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Windows\system32\sc.exe
      sc create "System Diagnostics Host" binPath= "C:\Windows\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto
      4⤵
      Launches sc.exe
      PID:4444
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c sc description "System Diagnostics Host" "Monitors and manages system diagnostic tasks." & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Windows\system32\sc.exe
      sc description "System Diagnostics Host" "Monitors and manages system diagnostic tasks."
      4⤵
      Launches sc.exe
      PID:2076
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c sc start "System Diagnostics Host" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:412
  - - C:\Windows\system32\sc.exe
      sc start "System Diagnostics Host"
      4⤵
      Launches sc.exe
      PID:4492
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall show rule name="XCCProcess"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4544
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c netsh advfirewall firewall add rule name="XCCProcess" dir=in action=allow program="C:\Windows\Media\mppr.exe" enable=yes & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="XCCProcess" dir=in action=allow program="C:\Windows\Media\mppr.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:892
- - C:\Windows\Media\mppr.exe
    "C:\Windows\Media\mppr.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3288
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4036
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4728
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4540
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4832
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c sc query "System Diagnostics Host" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5000
    - - C:\Windows\system32\sc.exe
        
        sc query "System Diagnostics Host"
        5⤵
        Launches sc.exe
        
        PID:4976
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
      4⤵
      Executes a command shell one-liner
      PID:4972
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall show rule name="XCCProcess"
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yftlgz2y.hjn.bat""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Windows\system32\timeout.exe
      timeout 8
      4⤵
      Delays execution with timeout.exe
      PID:1148

C:\Windows\Media\mppr.exe
C:\Windows\Media\mppr.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3356
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4084
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:3780
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4816
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1628
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2900
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:4648
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4704
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  PID:1652
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1888
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:4876
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4196
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  PID:832
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:2832
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  PID:4048
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2332
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  PID:1368
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3424
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  PID:1172
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5092
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:3832
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:4216
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  PID:5020
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:776
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:2388
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4328
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:4992
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2736
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:540
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:1068
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:1920
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1048
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:1864
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2140
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  PID:3728
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2828
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:4688
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:1656
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:1440
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3572
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  PID:2012
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2512
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  PID:2112
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1780
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:4152
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:2844
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:1792
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4580
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:1424
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2924
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:3828
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3108
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:4476
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:5048
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:4320
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4160
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:2596
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4220
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:4064
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4360
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:2088
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:4928
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  PID:4704
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4140
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  PID:1880
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1772
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:2796
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1512
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:2772
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:2844
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  PID:4840
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3424
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  PID:4652
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3620
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  PID:2392
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4424
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  PID:2832
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:1068
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  PID:4888
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4116
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:1048
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4880
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  PID:2824
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3368
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:1944
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:1776
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:5096
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3152
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:2364
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3788
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  PID:4040
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1960
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  PID:2512
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:5004
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  PID:1780
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1460
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  PID:4084
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4664
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:3504
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2144
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:1248
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:2332
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:1624
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5048
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  PID:3968
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2840
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:4388
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3712
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  PID:4392
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:3164
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:3792
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4856
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:1420
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4908
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  PID:400
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2096
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:2812
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:1196
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:2516
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1960
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  PID:2728
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4556
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:2016
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4352
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  PID:3900
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:1720
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:2896
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4988
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:1020
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4404
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  PID:3024
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3152
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  PID:4752
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:1448
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  PID:2076
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:464
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  PID:4692
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3652
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:3784
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4868
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:1732
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:4460
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:3524
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1632
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:2788
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4500
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  PID:3056
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2736
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Executes a command shell one-liner
  PID:5076
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:3992
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:4236
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2208
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  PID:692
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2332
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:1068
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4324
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  PID:620
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:3804
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  PID:4928
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4624

C:\Windows\SysWOW64\SystemDiagnosticsHost.exe
C:\Windows\SysWOW64\SystemDiagnosticsHost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe
C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3372
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4968
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:2596
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:852
- C:\Windows\Media\mppr.exe
  "C:\Windows\Media\mppr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:4864
- - C:\Windows\system32\cmd.exe
    "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
    3⤵
    PID:4364
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3164
- - C:\Windows\system32\cmd.exe
    "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
    3⤵
    - Executes a command shell one-liner
    PID:4948
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1256
- - C:\Windows\system32\cmd.exe
    "cmd" /c sc query "System Diagnostics Host" & exit
    3⤵
    - Executes a command shell one-liner
    PID:5060
  - - C:\Windows\system32\sc.exe
      sc query "System Diagnostics Host"
      4⤵
      Launches sc.exe
      PID:4140
- - C:\Windows\system32\cmd.exe
    "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
    3⤵
    - Executes a command shell one-liner
    PID:640
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall show rule name="XCCProcess"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3792

C:\Windows\INF\usbhub\usbperfsym.exe
C:\Windows\INF\usbhub\usbperfsym.exe
1⤵
- Executes dropped EXE
PID:4924

C:\Windows\Media\mppr.exe
C:\Windows\Media\mppr.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1512
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:2468
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3716
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit
  2⤵
  - Executes a command shell one-liner
  PID:4160
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3620
- C:\Windows\system32\cmd.exe
  "cmd" /c sc query "System Diagnostics Host" & exit
  2⤵
  PID:4148
- - C:\Windows\system32\sc.exe
    sc query "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:692
- C:\Windows\system32\cmd.exe
  "cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit
  2⤵
  PID:436
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name="XCCProcess"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mppr.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mppr.exe.log
Size 1KB
SHA256 62633a710e2c898f063ccb26b4dba40732efc5c998be231802c679e0341998b8
MD5 994eed429a8fcc0242cf50f63834a62b
SHA1 fb5ce3cdc6d948af7b177ff1f7cea9236663da4a
SHA512 823bf879698a444e48e6b5fe0ffbca2a9957c6ff77a7d0e4ea12174844650b5c4f30edb7a54070025773f9ee7ad7e575ce6aef0fe8c0faf04a9fd53ce1b4428a
TLSH
T1F331AB722376B1D889163F422C6926C017FF0325B690DE1CB5A8725EDA3A0175F222E2
MD5 SHA1 SHA512 TLSH

Submit Download

RES915E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES915E.tmp
Size 1KB
SHA256 2b4235ae61aaa7335836a8f40c299abd7f513de1ac4b17e6b4649950e26a6aba
MD5 916450b83b5a23d9899abcc2cc25def7
SHA1 8ad94dd629b62c434261c5fd6c4595a671f67430
SHA512 f2f3ff822b80db494994e0de85f1c0e820b771dcda466dec68d2de9eac30e35e59aa6bcb7a3d98a6667564ebd2576833b6047fae0aa1318195e14716f0fc5fa9
TLSH
T1F3413340A3EC4B1AE172433129F7572AA278BE45AE99575DB488522E1E02744DDC3273
MD5 SHA1 SHA512 TLSH

Submit Download

RES93A0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES93A0.tmp
Size 1KB
SHA256 45804002deff5679c42df7b8fc7839c3133653a201344d017ddeff96c0ea423f
MD5 e117d973f0731e66b342d88a32be9f5e
SHA1 3be6b046c9e2ecd6377394e55d38772c3ca10c75
SHA512 a12c42481dc012410c4e1617caf84297fff3433d6bc9f91e67c839ba8a453c1e6b6db09a1e10c3fb901be981cf02d11d91eb44e102ca02aece1a8361b85b55ae
TLSH
T104413144A3EC4B1EE173433129FB4729B278BE55AEA9575EB484522E6E01780DDC32B2
MD5 SHA1 SHA512 TLSH

Submit Download

TmpBB6B.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpBB6B.tmp
Size 1KB
SHA256 7813a057e1a1fa60c1aaff61f86584bba71273ede1ec8670e744c3df1949d5cc
MD5 58d6e8e8cd928c49d87a54951cd14c39
SHA1 cecb11253b46b0033fbc0152cb4316e7e17c814a
SHA512 7a3934901c017bdca51579acceddf7c26c26e49e2b89905e674fcb45e3d7828d4dfaab8ad76c3c0b623f471e1df1d73a1a8f16fbcbc3dfaba3e46c9cf554cdf5
TLSH
T19331C9EE70B726C51301B5780DDE9E0655BB01329EE5CD4F71633280A9A452BA5C9108
MD5 SHA1 SHA512 TLSH

Submit Download

tmp6ACB.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp6ACB.tmp.exe
Size 1.0MB
SHA256 eea60c3ce6f32625d9fdf17fb1d648a248fa058f4ca1c9ba13684ff8ddab151e
MD5 cc8784f78159d5ae9aad8e8ad363a8f4
SHA1 983f19e557ff9d6d23b6bcb9b071de5dd1181f75
SHA512 41ac3b397238f18f08038f94b920deba518bfef9e96d6ba5b519c5788d9e018a86a91b8bc51936c5baae49211320fed302b16ba435886c15c8358080708a53ea
SSDEEP 12288:QkbTiQE3/H8PiBwAB02FPjpgdsr+pS4RikcUgvIr:QUiQW/Huw/aLdYna
TLSH
T1933539543698BD57E16A5F310097A3F144EDACE70A708489AA877EECC078593BFDCB06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp8FF6.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp8FF6.tmp
Size 2.7MB
SHA256 7d67e0b15cf58abaf4714a3691ff3e0e51becad2e017f3b0e1d102770a50c16e
MD5 f7bf1c733138c002cc8682a05fc8ded4
SHA1 08e607463748b650ab6dda4ac4fe9ea32b12fc4c
SHA512 175eafda5bc908ef8b1ab84488df00063888027fbdb2da9c937c14f24209e9a0bf74f239af72a40d7fb6056ead13ff56b5fda99de75a0cab2438292c8725c326
SSDEEP 12288:xzvxsupIITWeU3fLaoPs0M2yeRYd5SXy7sZOm9O3pZXFO6baS0m5jN/CqcWIldQu:Luur58wlrqqOJf8KR
TLSH
T162D5363938FA00BF70BBAED96BD92865B93DF2FE2F475865113403C10B96C019D9166B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp92D6.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp92D6.tmp
Size 2.7MB
SHA256 66fcd6917038823b619d58272567e1366d539c8a1a19e8d37dbb5dbf2c87a666
MD5 1d7012c69308a9348ce8c3ecbb67bea6
SHA1 a6839c560ccc314915ce68fef4bb92e3ce4faf4a
SHA512 d7c5a5df8e4035fa7cd2fd4a94dd612263f31d5f2274def0ea92995ffe48aeb7ab3523276e45d41730e9edb57f71e41cbf81898d8c09ffb68f78f26bc9f44ad9
SSDEEP 12288:AbK4IiVAItgGtec6oLuTHyaq3EMQjR8iJcgpu9aVY30GYi2+xe5ob0eaan0JYb5r:OtMcPmR8TEeaanwa
TLSH
T1D1D5F31935FB404B6C36AD581FD8E87FC93AF621161D347E1128868E8713B49DDBE0BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yftlgz2y.hjn.bat

Path C:\Users\Admin\AppData\Local\Temp\yftlgz2y.hjn.bat
Size 155B
SHA256 35940a0a1bc5d1919ac4d65b84eee5481af50d9a6cc3b4ea666f84c7b4018a51
MD5 00a6eeaa572b0bb423bdea985b204857
SHA1 0bdd192443c3f167f67ee04aa2f7b8731962d253
SHA512 a61c671f2929e024b59eb197f3eac67068be3e28afa4eaaca8af628f31021c057fa69420b6cbebbf06ab38751d22ad29fbd1ee205a0434278a3c359dbfa6fb0b
TLSH
T1D9C02B0250CBC71A0E04B01726BA818EC0F39E393E03FB60530C844820A189EF8FB342
MD5 SHA1 SHA512 TLSH

Submit Download

msldriver.dll

Path C:\Windows\Media\msldriver.dll
Size 159KB
SHA256 87335a3c7f3ad7284a11f18e02afb8b4435ea11a0c43488565f428b422e5a363
MD5 3dde5da705aa8ff971adac73db7df7a4
SHA1 0f629e18a94fcb0c45574d4c39b5dd7998f28c8f
SHA512 d7676374e9e427981d97a930327c51bb52f330353b80ea718c555deef7e56d84243e86d7343277bf4d633fb92fde00eee5f507318a4d883e9bb484ecc89c0020
SSDEEP 3072:zovJL1Hr4Pa5gmJu3XzLUjO0XOVTzWf+4c:EvvL4Pa5DJu3DKOKOVN
TLSH
T196F35A1773A500BBE5678278C8A31A02F7B2B8114721DBAF03A447766F277D19D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemDiagnosticsHost.exe

Path C:\Windows\SysWOW64\SystemDiagnosticsHost.exe
Size 18KB
SHA256 eb2d6a5069054048f2b960542d0fe19d5c4d62d63512230f6eb6951bf0dd8271
MD5 9c89388860f676cc34ee9d36c2779778
SHA1 384575d230f0c6abfee1067ac9f235715b2fc991
SHA512 f7ebb85185b67e1a8d04b4f944a58b997a3105158352d89b508bbeb75461b36501eae7fa55a94ca47a840bd7d445d95b840aaedfc3109ef7d32f36828cbcf2aa
SSDEEP 192:Nv14OdpzbQ/r+oCgWc7ezhuwLO+0EJyHB7wYKW9eeQ5MHzgWi0lnz2R:Nv1Fzzb0r+qWc7q9UBmW9eeQ53ez2
TLSH
T11F82F8126ED44126F9B90B32D8E1F24312B06915CD63DF6E46C42B5FD83099CAB3A7ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4zok3yyy.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\4zok3yyy\4zok3yyy.0.cs
Size 1.4MB
SHA256 e3d8d020cce8846a7e497f67cd6e4cc47c2e7ac8e0fc683c52bbea31164996aa
MD5 72d517964ba7c9bb94b0871bf9de2de1
SHA1 13b330911285a18be9f9825dee23cc24db6ac6de
SHA512 51200fadc014bdb50d9d461f5aec3cc77fcc48e36516ed7169e145085109514843ec643267127d8290ad68dd18ad946f9c68716066ad016b4d131743a2eacd06
SSDEEP 24576:Uc9fK0PpUlk43/TjD3Fn0W3e55cFReh4cA2s:UcRKvbHFn0W3e55c7W4cA2s
TLSH
T15F657AA5FE423E930BB593411ACF7EC0A6ED771B42E8DB50ED18C28342C35A923D7656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4zok3yyy.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\4zok3yyy\4zok3yyy.cmdline
Size 368B
SHA256 8a7e26116a6de84744b9b069f630f2bc73170698d0a0030c3c6fcdf32cf1dfb9
MD5 68ffebbbe9d756511006299def48cd82
SHA1 a4c66879287640cc86c6a0db4de2b2a362786da5
SHA512 05694a9ac95d972e47f5af4bb7c3e36c4b7793b3707bb492906b2d275252156a60c304bb03db9ff586def300b3188f10c6aae8525a90736b16968b34296b9fa4
TLSH
T1C3E0DF3F43AAC7BD5128651B40D5C8DC52F2571B290EFFA8E1D15888823F898B3E0A46
MD5 SHA1 SHA512 TLSH

Submit Download

CSC277FB8E75A564FC289267EF9B5A9BBE0.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC277FB8E75A564FC289267EF9B5A9BBE0.TMP
Size 1KB
SHA256 5a0a6541c2389bc936d098e8691c855db31810b67ca088dcf37bc15457f7f1f7
MD5 b0d97465c4fe9787e4fc2774e6f85cae
SHA1 7c114b1513e94c6006838791e9f5814243e3c416
SHA512 9a7df216b36b32ac239062007e037b5859eb27da5b98b728dfb5a0da57f82aa38561fe962a9f08a550a5469cfea8ecf34f68548c32a776328d81ef7b3aae748e
TLSH
T1AB21C949B2EC521EF2B3477069F68362A16CBE52DC7D83EC34C8135F2F15A4084836B1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC512C5C904ADE4C92B34D8172C88FE42E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC512C5C904ADE4C92B34D8172C88FE42E.TMP
Size 1KB
SHA256 d3993663307dc0d95ddd87a2012454c358f3f72a2443412a2435d38b509b3b68
MD5 5ed2fe2adbebe0844926aadd89dbcf43
SHA1 1d18a36904f6bd1affbb3172d0fdd7ef9fa7b949
SHA512 6c38e5c02e37f384ec71cb823c35f5ee625f12882368411eac2b0c352df8bc2e5081dd2eec6bd6220470b9331b71f0e12eb4080ed8ca4edaf529da752060e2d5
TLSH
T11D21AB81B2FC520EF2B3477069F28363A16CBE56DD7983EC3488535F2F15A1585836B2
MD5 SHA1 SHA512 TLSH

Submit Download

oznuhmx4.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\oznuhmx4\oznuhmx4.0.cs
Size 1.4MB
SHA256 62e17ec78a8dd54c4765c93282bd8d5e1aebaeef6d3b9ea4db983b41bb89b777
MD5 207264b83b03513663fe16afb3788bca
SHA1 38b626c1f7db41e9fdb67b48f5d770d516e540ab
SHA512 1d60cdcf8832fd0f81f5c42dea2c08b822344620d6a7bf18c32e657c4197a1bc390a20a91eb8eb94e3eb325757ff3a0a7b2c65056b7a5e173a8920863bca750c
SSDEEP 12288:6UY6PNvUi7rSuZ1ivZHDfPVDS3s7mkeE0C:9i6/ZUB5lmkeEX
TLSH
T15D654434CFEA8157FCA2B099F9B56174DB3CDA68AB962FF541446EF14C061090B8FA1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oznuhmx4.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\oznuhmx4\oznuhmx4.cmdline
Size 368B
SHA256 7381208d287fb4ae9c5456c368afe23809d3ff791f6bbb91eeb1eed941bcf278
MD5 f0f3578d998b12ac51432a7b9b5abcb7
SHA1 b122cdfd8c5ee49b2c045a5c3030fc987a598fab
SHA512 471645269fc2e52562fb34663c86245911b3080764de21010825b5e4a3d3579c2e913fc8efb6003c9ccc42f901d329d6d35211b5809b12ced1c139c2e7138d62
TLSH
T196E0923E4369CBBD5529510B5095C8DC52F30616394ABEE8B1C10844823F4A976E0D46
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1788-0-0x0000000000450000-0x000000000070C000-memory.dmp

Download

memory/3224-184-0x00000000025E0000-0x00000000025E1000-memory.dmp

Download

memory/4280-148-0x0000000000880000-0x000000000088A000-memory.dmp

Download

memory/4280-149-0x0000000003E20000-0x0000000003E42000-memory.dmp

Download

memory/4924-154-0x00000000005E0000-0x000000000089C000-memory.dmp

Download

memory/4980-44-0x000001DF99D50000-0x000001DF99D60000-memory.dmp

Download

memory/4980-56-0x000001DFFF4E0000-0x000001DFFF4F2000-memory.dmp

Download

memory/4980-14-0x000001DF99D50000-0x000001DF99D60000-memory.dmp

Download

memory/4980-13-0x000001DFFEC60000-0x000001DFFED6A000-memory.dmp

Download