e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 09:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Size 5.1MB
Sample260728-k9j9msgd39
SHA256 e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223
MD5 c108c79539b09aeeeb6f71b00f02c9f5
SHA1 39f1cfb7c73421e3d1d10aea9715bbc2d3321e10
SHA512 d66dd4935f48290dc1d6f4de1167cb241010bc487611365146852e42ac1f21b14a6bde53f23161de186d03374147a59003d5716cc978455c6f64df6efbba0900
SSDEEP 98304:qKdSu1FIHTM6UyvpacLP5caDJaEfEdvzX3:SuWTTvp5LPw
TLSH
T1D8461A43A5D74CE9C9D7E77852DB6232A730BD2586396F3A5B44CB312E537C0A92EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4588	netsh.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
408	arp.exe
3744	arp.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
3852	netstat.exe

Checks SCSI registry key(s) 3 TTPs 21 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ClassGUID	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ClassGUID	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ClassGUID	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ClassGUID	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LocationInformation	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4664	ipconfig.exe
3852	netstat.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1680	wmic.exe
Token: SeSecurityPrivilege	1680	wmic.exe
Token: SeTakeOwnershipPrivilege	1680	wmic.exe
Token: SeLoadDriverPrivilege	1680	wmic.exe
Token: SeSystemProfilePrivilege	1680	wmic.exe
Token: SeSystemtimePrivilege	1680	wmic.exe
Token: SeProfSingleProcessPrivilege	1680	wmic.exe
Token: SeIncBasePriorityPrivilege	1680	wmic.exe
Token: SeCreatePagefilePrivilege	1680	wmic.exe
Token: SeBackupPrivilege	1680	wmic.exe
Token: SeRestorePrivilege	1680	wmic.exe
Token: SeShutdownPrivilege	1680	wmic.exe
Token: SeDebugPrivilege	1680	wmic.exe
Token: SeSystemEnvironmentPrivilege	1680	wmic.exe
Token: SeRemoteShutdownPrivilege	1680	wmic.exe
Token: SeUndockPrivilege	1680	wmic.exe
Token: SeManageVolumePrivilege	1680	wmic.exe
Token: 33	1680	wmic.exe
Token: 34	1680	wmic.exe
Token: 35	1680	wmic.exe
Token: 36	1680	wmic.exe
Token: SeIncreaseQuotaPrivilege	1680	wmic.exe
Token: SeSecurityPrivilege	1680	wmic.exe
Token: SeTakeOwnershipPrivilege	1680	wmic.exe
Token: SeLoadDriverPrivilege	1680	wmic.exe
Token: SeSystemProfilePrivilege	1680	wmic.exe
Token: SeSystemtimePrivilege	1680	wmic.exe
Token: SeProfSingleProcessPrivilege	1680	wmic.exe
Token: SeIncBasePriorityPrivilege	1680	wmic.exe
Token: SeCreatePagefilePrivilege	1680	wmic.exe
Token: SeBackupPrivilege	1680	wmic.exe
Token: SeRestorePrivilege	1680	wmic.exe
Token: SeShutdownPrivilege	1680	wmic.exe
Token: SeDebugPrivilege	1680	wmic.exe
Token: SeSystemEnvironmentPrivilege	1680	wmic.exe
Token: SeRemoteShutdownPrivilege	1680	wmic.exe
Token: SeUndockPrivilege	1680	wmic.exe
Token: SeManageVolumePrivilege	1680	wmic.exe
Token: 33	1680	wmic.exe
Token: 34	1680	wmic.exe
Token: 35	1680	wmic.exe
Token: 36	1680	wmic.exe
Token: SeIncreaseQuotaPrivilege	2116	wmic.exe
Token: SeSecurityPrivilege	2116	wmic.exe
Token: SeTakeOwnershipPrivilege	2116	wmic.exe
Token: SeLoadDriverPrivilege	2116	wmic.exe
Token: SeSystemProfilePrivilege	2116	wmic.exe
Token: SeSystemtimePrivilege	2116	wmic.exe
Token: SeProfSingleProcessPrivilege	2116	wmic.exe
Token: SeIncBasePriorityPrivilege	2116	wmic.exe
Token: SeCreatePagefilePrivilege	2116	wmic.exe
Token: SeBackupPrivilege	2116	wmic.exe
Token: SeRestorePrivilege	2116	wmic.exe
Token: SeShutdownPrivilege	2116	wmic.exe
Token: SeDebugPrivilege	2116	wmic.exe
Token: SeSystemEnvironmentPrivilege	2116	wmic.exe
Token: SeRemoteShutdownPrivilege	2116	wmic.exe
Token: SeUndockPrivilege	2116	wmic.exe
Token: SeManageVolumePrivilege	2116	wmic.exe
Token: 33	2116	wmic.exe
Token: 34	2116	wmic.exe
Token: 35	2116	wmic.exe
Token: 36	2116	wmic.exe
Token: SeIncreaseQuotaPrivilege	2116	wmic.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 1680	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	86
PID 4452 wrote to memory of 2116	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	88
PID 4452 wrote to memory of 4320	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	89
PID 4452 wrote to memory of 2940	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	90
PID 4452 wrote to memory of 1692	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	91
PID 4452 wrote to memory of 1664	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	92
PID 4452 wrote to memory of 2720	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	93
PID 4452 wrote to memory of 3712	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	94
PID 4452 wrote to memory of 3328	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	95
PID 4452 wrote to memory of 4340	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	96
PID 4452 wrote to memory of 5052	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	97
PID 4452 wrote to memory of 2260	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	98
PID 4452 wrote to memory of 3692	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	99
PID 4452 wrote to memory of 4664	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	100
PID 4452 wrote to memory of 408	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	101
PID 4452 wrote to memory of 3840	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	102
PID 4452 wrote to memory of 1996	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	103
PID 4452 wrote to memory of 2812	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	104
PID 4452 wrote to memory of 3852	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	105
PID 4452 wrote to memory of 3744	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	106
PID 4452 wrote to memory of 3380	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	107
PID 4452 wrote to memory of 4012	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	108
PID 4452 wrote to memory of 1480	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	109
PID 4452 wrote to memory of 4588	4452	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	110

C:\Users\Admin\AppData\Local\Temp\e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
"C:\Users\Admin\AppData\Local\Temp\e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe"
1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\System32\Wbem\wmic.exe
  wmic path Win32_VideoController get PNPDeviceID /format:list
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1680
- C:\Windows\System32\Wbem\wmic.exe
  wmic sounddev get PNPDeviceID /format:list
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2116
- C:\Windows\System32\Wbem\wmic.exe
  wmic memorychip get PartNumber,Speed /format:list
  2⤵
  PID:4320
- C:\Windows\System32\Wbem\wmic.exe
  wmic bios get SMBIOSBIOSVersion,ReleaseDate /format:list
  2⤵
  PID:2940
- C:\Windows\System32\Wbem\wmic.exe
  wmic memorychip get DeviceLocator,BankLabel /format:list
  2⤵
  PID:1692
- C:\Windows\System32\Wbem\wmic.exe
  wmic memorychip get Manufacturer /format:list
  2⤵
  PID:1664
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get MACAddress /format:list
  2⤵
  PID:2720
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get NetConnectionStatus /format:list
  2⤵
  PID:3712
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get AdapterType /format:list
  2⤵
  PID:3328
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4340
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get Description /format:list
  2⤵
  PID:5052
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get Manufacturer /format:list
  2⤵
  PID:2260
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get PNPDeviceID /format:list
  2⤵
  PID:3692
- C:\Windows\SYSTEM32\ipconfig.exe
  "ipconfig"
  2⤵
  - Gathers network information
  PID:4664
- C:\Windows\SYSTEM32\arp.exe
  "arp" -a
  2⤵
  - Network Service Discovery
  PID:408
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get Index /format:list
  2⤵
  PID:3840
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get InterfaceIndex /format:list
  2⤵
  PID:1996
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get PhysicalAdapter /format:list
  2⤵
  PID:2812
- C:\Windows\SYSTEM32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  PID:3852
- C:\Windows\SYSTEM32\arp.exe
  "arp" -a
  2⤵
  - Network Service Discovery
  PID:3744
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface ipv6 show address
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3380
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4012
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show drivers
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1480
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall firewall show rule name=all
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4588