e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 09:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Size 5.1MB
Sample260728-k9j9msgd39
SHA256 e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223
MD5 c108c79539b09aeeeb6f71b00f02c9f5
SHA1 39f1cfb7c73421e3d1d10aea9715bbc2d3321e10
SHA512 d66dd4935f48290dc1d6f4de1167cb241010bc487611365146852e42ac1f21b14a6bde53f23161de186d03374147a59003d5716cc978455c6f64df6efbba0900
SSDEEP 98304:qKdSu1FIHTM6UyvpacLP5caDJaEfEdvzX3:SuWTTvp5LPw
TLSH
T1D8461A43A5D74CE9C9D7E77852DB6232A730BD2586396F3A5B44CB312E537C0A92EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3192	netsh.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4592	arp.exe
4584	arp.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
3124	netstat.exe

Checks SCSI registry key(s) 3 TTPs 21 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ClassGUID	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ClassGUID	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LocationInformation	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ClassGUID	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ClassGUID	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6088	ipconfig.exe
3124	netstat.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
5720	wmic.exe
5720	wmic.exe
5720	wmic.exe
5720	wmic.exe
1124	wmic.exe
1124	wmic.exe
1124	wmic.exe
1124	wmic.exe
4384	wmic.exe
4384	wmic.exe
4384	wmic.exe
4384	wmic.exe
2108	wmic.exe
2108	wmic.exe
2108	wmic.exe
2108	wmic.exe
3472	wmic.exe
3472	wmic.exe
3472	wmic.exe
3472	wmic.exe
5960	wmic.exe
5960	wmic.exe
5960	wmic.exe
5960	wmic.exe
5984	wmic.exe
5984	wmic.exe
5984	wmic.exe
5984	wmic.exe
4240	wmic.exe
4240	wmic.exe
4240	wmic.exe
4240	wmic.exe
3156	wmic.exe
3156	wmic.exe
3156	wmic.exe
3156	wmic.exe
6072	wmic.exe
6072	wmic.exe
6072	wmic.exe
6072	wmic.exe
1624	wmic.exe
1624	wmic.exe
1624	wmic.exe
1624	wmic.exe
5916	wmic.exe
5916	wmic.exe
5916	wmic.exe
5916	wmic.exe
1452	wmic.exe
1452	wmic.exe
1452	wmic.exe
1452	wmic.exe
1932	wmic.exe
1932	wmic.exe
1932	wmic.exe
1932	wmic.exe
4540	wmic.exe
4540	wmic.exe
4540	wmic.exe
4540	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5720	wmic.exe
Token: SeSecurityPrivilege	5720	wmic.exe
Token: SeTakeOwnershipPrivilege	5720	wmic.exe
Token: SeLoadDriverPrivilege	5720	wmic.exe
Token: SeSystemProfilePrivilege	5720	wmic.exe
Token: SeSystemtimePrivilege	5720	wmic.exe
Token: SeProfSingleProcessPrivilege	5720	wmic.exe
Token: SeIncBasePriorityPrivilege	5720	wmic.exe
Token: SeCreatePagefilePrivilege	5720	wmic.exe
Token: SeBackupPrivilege	5720	wmic.exe
Token: SeRestorePrivilege	5720	wmic.exe
Token: SeShutdownPrivilege	5720	wmic.exe
Token: SeDebugPrivilege	5720	wmic.exe
Token: SeSystemEnvironmentPrivilege	5720	wmic.exe
Token: SeRemoteShutdownPrivilege	5720	wmic.exe
Token: SeUndockPrivilege	5720	wmic.exe
Token: SeManageVolumePrivilege	5720	wmic.exe
Token: 33	5720	wmic.exe
Token: 34	5720	wmic.exe
Token: 35	5720	wmic.exe
Token: 36	5720	wmic.exe
Token: SeIncreaseQuotaPrivilege	5720	wmic.exe
Token: SeSecurityPrivilege	5720	wmic.exe
Token: SeTakeOwnershipPrivilege	5720	wmic.exe
Token: SeLoadDriverPrivilege	5720	wmic.exe
Token: SeSystemProfilePrivilege	5720	wmic.exe
Token: SeSystemtimePrivilege	5720	wmic.exe
Token: SeProfSingleProcessPrivilege	5720	wmic.exe
Token: SeIncBasePriorityPrivilege	5720	wmic.exe
Token: SeCreatePagefilePrivilege	5720	wmic.exe
Token: SeBackupPrivilege	5720	wmic.exe
Token: SeRestorePrivilege	5720	wmic.exe
Token: SeShutdownPrivilege	5720	wmic.exe
Token: SeDebugPrivilege	5720	wmic.exe
Token: SeSystemEnvironmentPrivilege	5720	wmic.exe
Token: SeRemoteShutdownPrivilege	5720	wmic.exe
Token: SeUndockPrivilege	5720	wmic.exe
Token: SeManageVolumePrivilege	5720	wmic.exe
Token: 33	5720	wmic.exe
Token: 34	5720	wmic.exe
Token: 35	5720	wmic.exe
Token: 36	5720	wmic.exe
Token: SeIncreaseQuotaPrivilege	1124	wmic.exe
Token: SeSecurityPrivilege	1124	wmic.exe
Token: SeTakeOwnershipPrivilege	1124	wmic.exe
Token: SeLoadDriverPrivilege	1124	wmic.exe
Token: SeSystemProfilePrivilege	1124	wmic.exe
Token: SeSystemtimePrivilege	1124	wmic.exe
Token: SeProfSingleProcessPrivilege	1124	wmic.exe
Token: SeIncBasePriorityPrivilege	1124	wmic.exe
Token: SeCreatePagefilePrivilege	1124	wmic.exe
Token: SeBackupPrivilege	1124	wmic.exe
Token: SeRestorePrivilege	1124	wmic.exe
Token: SeShutdownPrivilege	1124	wmic.exe
Token: SeDebugPrivilege	1124	wmic.exe
Token: SeSystemEnvironmentPrivilege	1124	wmic.exe
Token: SeRemoteShutdownPrivilege	1124	wmic.exe
Token: SeUndockPrivilege	1124	wmic.exe
Token: SeManageVolumePrivilege	1124	wmic.exe
Token: 33	1124	wmic.exe
Token: 34	1124	wmic.exe
Token: 35	1124	wmic.exe
Token: 36	1124	wmic.exe
Token: SeIncreaseQuotaPrivilege	1124	wmic.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 5720	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	90
PID 4644 wrote to memory of 1124	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	92
PID 4644 wrote to memory of 4384	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	93
PID 4644 wrote to memory of 2108	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	94
PID 4644 wrote to memory of 3472	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	95
PID 4644 wrote to memory of 5960	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	96
PID 4644 wrote to memory of 5984	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	97
PID 4644 wrote to memory of 4240	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	98
PID 4644 wrote to memory of 3156	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	99
PID 4644 wrote to memory of 6056	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	100
PID 4644 wrote to memory of 6072	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	101
PID 4644 wrote to memory of 1624	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	102
PID 4644 wrote to memory of 5916	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	103
PID 4644 wrote to memory of 6088	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	104
PID 4644 wrote to memory of 4592	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	105
PID 4644 wrote to memory of 1452	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	106
PID 4644 wrote to memory of 1932	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	107
PID 4644 wrote to memory of 4540	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	108
PID 4644 wrote to memory of 3124	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	109
PID 4644 wrote to memory of 4584	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	110
PID 4644 wrote to memory of 4652	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	111
PID 4644 wrote to memory of 4896	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	112
PID 4644 wrote to memory of 3988	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	113
PID 4644 wrote to memory of 3192	4644	e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe	114

C:\Users\Admin\AppData\Local\Temp\e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe
"C:\Users\Admin\AppData\Local\Temp\e1645a97afc1f978ecfa36cd707f2384ba03406f782de08bdb0007843dda5223.exe"
1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\System32\Wbem\wmic.exe
  wmic path Win32_VideoController get PNPDeviceID /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5720
- C:\Windows\System32\Wbem\wmic.exe
  wmic sounddev get PNPDeviceID /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1124
- C:\Windows\System32\Wbem\wmic.exe
  wmic memorychip get PartNumber,Speed /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Windows\System32\Wbem\wmic.exe
  wmic bios get SMBIOSBIOSVersion,ReleaseDate /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2108
- C:\Windows\System32\Wbem\wmic.exe
  wmic memorychip get DeviceLocator,BankLabel /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3472
- C:\Windows\System32\Wbem\wmic.exe
  wmic memorychip get Manufacturer /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5960
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get MACAddress /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5984
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get NetConnectionStatus /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4240
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get AdapterType /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3156
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:6056
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get Description /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6072
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get Manufacturer /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1624
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get PNPDeviceID /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5916
- C:\Windows\SYSTEM32\ipconfig.exe
  "ipconfig"
  2⤵
  - Gathers network information
  PID:6088
- C:\Windows\SYSTEM32\arp.exe
  "arp" -a
  2⤵
  - Network Service Discovery
  PID:4592
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get Index /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1452
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get InterfaceIndex /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get PhysicalAdapter /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4540
- C:\Windows\SYSTEM32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  PID:3124
- C:\Windows\SYSTEM32\arp.exe
  "arp" -a
  2⤵
  - Network Service Discovery
  PID:4584
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface ipv6 show address
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4652
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4896
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show drivers
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3988
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall firewall show rule name=all
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3192