Executes dropped EXE

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

Legitimate hosting services abused for malware hosting/C2

Network Service Discovery

Attempt to gather information on host's network.

Suspicious use of NtSetInformationThreadHideFromDebugger