8562c02de7024f2281c7fe687e12afa8f26ee6548d1b2cbe7956e39b04d51413

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SpotifyHelper.lnk	cscript.exe

Executes dropped EXE 4 IoCs

pid	Process
6928	s240735953.exe
3324	a240735953.exe
6628	SpotifyHelper.exe
7152	SpotifyHelper.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

persistence privilege_escalation

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\SpotifyHelper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SpotifyHelper\\SpotifyHelper.exe"	s240735953.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5772	cscript.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3324	a240735953.exe
3324	a240735953.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 54 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5048	cmd.exe
3308	cmd.exe
6396	cmd.exe
4488	cmd.exe
916	cmd.exe
2628	cmd.exe
3856	cmd.exe
6284	cmd.exe
3488	cmd.exe
3020	cmd.exe
2832	cmd.exe
2596	cmd.exe
2224	cmd.exe
256	cmd.exe
6324	cmd.exe
6208	cmd.exe
2920	cmd.exe
3248	cmd.exe
1216	cmd.exe
5776	cmd.exe
3608	cmd.exe
6696	cmd.exe
4940	cmd.exe
2072	cmd.exe
5132	cmd.exe
3392	cmd.exe
5648	cmd.exe
6700	cmd.exe
4268	cmd.exe
5520	cmd.exe
6608	cmd.exe
6548	cmd.exe
6520	cmd.exe
6004	cmd.exe
1480	cmd.exe
6280	cmd.exe
2140	cmd.exe
1020	cmd.exe
6960	cmd.exe
1952	cmd.exe
1556	cmd.exe
1688	cmd.exe
6904	cmd.exe
4740	cmd.exe
6172	cmd.exe
5472	cmd.exe
5876	cmd.exe
1228	cmd.exe
4240	cmd.exe
5924	cmd.exe
2500	cmd.exe
5656	cmd.exe
6276	cmd.exe
5476	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2596	cmd.exe
5660	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	s240735953.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	s240735953.exe

Detects videocard installed 1 TTPs 24 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
4856	WMIC.exe
5320	WMIC.exe
6736	WMIC.exe
4748	WMIC.exe
6308	WMIC.exe
3000	WMIC.exe
2104	WMIC.exe
3380	WMIC.exe
1912	WMIC.exe
4332	WMIC.exe
4444	WMIC.exe
1172	WMIC.exe
6940	WMIC.exe
1892	WMIC.exe
5892	WMIC.exe
5816	WMIC.exe
6300	WMIC.exe
4444	WMIC.exe
4400	WMIC.exe
6552	WMIC.exe
4416	WMIC.exe
7112	WMIC.exe
1636	WMIC.exe
5792	WMIC.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
4104	ipconfig.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3492	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6188	WMIC.exe
6188	WMIC.exe
6188	WMIC.exe
6188	WMIC.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
4416	WMIC.exe
4416	WMIC.exe
4416	WMIC.exe
4416	WMIC.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3972	WMIC.exe
3972	WMIC.exe
3972	WMIC.exe
3972	WMIC.exe
3324	a240735953.exe
3324	a240735953.exe
2104	WMIC.exe
2104	WMIC.exe
2104	WMIC.exe
2104	WMIC.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe
3324	a240735953.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3324	a240735953.exe
6928	s240735953.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	6188	WMIC.exe
Token: SeSecurityPrivilege	6188	WMIC.exe
Token: SeTakeOwnershipPrivilege	6188	WMIC.exe
Token: SeLoadDriverPrivilege	6188	WMIC.exe
Token: SeSystemProfilePrivilege	6188	WMIC.exe
Token: SeSystemtimePrivilege	6188	WMIC.exe
Token: SeProfSingleProcessPrivilege	6188	WMIC.exe
Token: SeIncBasePriorityPrivilege	6188	WMIC.exe
Token: SeCreatePagefilePrivilege	6188	WMIC.exe
Token: SeBackupPrivilege	6188	WMIC.exe
Token: SeRestorePrivilege	6188	WMIC.exe
Token: SeShutdownPrivilege	6188	WMIC.exe
Token: SeDebugPrivilege	6188	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6188	WMIC.exe
Token: SeRemoteShutdownPrivilege	6188	WMIC.exe
Token: SeUndockPrivilege	6188	WMIC.exe
Token: SeManageVolumePrivilege	6188	WMIC.exe
Token: 33	6188	WMIC.exe
Token: 34	6188	WMIC.exe
Token: 35	6188	WMIC.exe
Token: 36	6188	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6188	WMIC.exe
Token: SeSecurityPrivilege	6188	WMIC.exe
Token: SeTakeOwnershipPrivilege	6188	WMIC.exe
Token: SeLoadDriverPrivilege	6188	WMIC.exe
Token: SeSystemProfilePrivilege	6188	WMIC.exe
Token: SeSystemtimePrivilege	6188	WMIC.exe
Token: SeProfSingleProcessPrivilege	6188	WMIC.exe
Token: SeIncBasePriorityPrivilege	6188	WMIC.exe
Token: SeCreatePagefilePrivilege	6188	WMIC.exe
Token: SeBackupPrivilege	6188	WMIC.exe
Token: SeRestorePrivilege	6188	WMIC.exe
Token: SeShutdownPrivilege	6188	WMIC.exe
Token: SeDebugPrivilege	6188	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6188	WMIC.exe
Token: SeRemoteShutdownPrivilege	6188	WMIC.exe
Token: SeUndockPrivilege	6188	WMIC.exe
Token: SeManageVolumePrivilege	6188	WMIC.exe
Token: 33	6188	WMIC.exe
Token: 34	6188	WMIC.exe
Token: 35	6188	WMIC.exe
Token: 36	6188	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4416	WMIC.exe
Token: SeSecurityPrivilege	4416	WMIC.exe
Token: SeTakeOwnershipPrivilege	4416	WMIC.exe
Token: SeLoadDriverPrivilege	4416	WMIC.exe
Token: SeSystemProfilePrivilege	4416	WMIC.exe
Token: SeSystemtimePrivilege	4416	WMIC.exe
Token: SeProfSingleProcessPrivilege	4416	WMIC.exe
Token: SeIncBasePriorityPrivilege	4416	WMIC.exe
Token: SeCreatePagefilePrivilege	4416	WMIC.exe
Token: SeBackupPrivilege	4416	WMIC.exe
Token: SeRestorePrivilege	4416	WMIC.exe
Token: SeShutdownPrivilege	4416	WMIC.exe
Token: SeDebugPrivilege	4416	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4416	WMIC.exe
Token: SeRemoteShutdownPrivilege	4416	WMIC.exe
Token: SeUndockPrivilege	4416	WMIC.exe
Token: SeManageVolumePrivilege	4416	WMIC.exe
Token: 33	4416	WMIC.exe
Token: 34	4416	WMIC.exe
Token: 35	4416	WMIC.exe
Token: 36	4416	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4416	WMIC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3324	a240735953.exe
1884	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6100 wrote to memory of 6928	6100	2026-08-15_19585609c3422d89b43fa137097e3ca0_icedid_njrat_quasar-rat.exe	91
PID 6928 wrote to memory of 5656	6928	s240735953.exe	92
PID 5656 wrote to memory of 5772	5656	cmd.exe	94
PID 6928 wrote to memory of 5648	6928	s240735953.exe	95
PID 5648 wrote to memory of 3492	5648	cmd.exe	97
PID 6928 wrote to memory of 6700	6928	s240735953.exe	98
PID 6700 wrote to memory of 6188	6700	cmd.exe	100
PID 6700 wrote to memory of 3404	6700	cmd.exe	101
PID 6700 wrote to memory of 4508	6700	cmd.exe	102
PID 6928 wrote to memory of 1216	6928	s240735953.exe	103
PID 6100 wrote to memory of 3324	6100	2026-08-15_19585609c3422d89b43fa137097e3ca0_icedid_njrat_quasar-rat.exe	107
PID 1216 wrote to memory of 4416	1216	cmd.exe	108
PID 1216 wrote to memory of 4312	1216	cmd.exe	109
PID 1216 wrote to memory of 4872	1216	cmd.exe	110
PID 6928 wrote to memory of 6520	6928	s240735953.exe	114
PID 6520 wrote to memory of 3972	6520	cmd.exe	116
PID 6520 wrote to memory of 2992	6520	cmd.exe	117
PID 6520 wrote to memory of 5036	6520	cmd.exe	118
PID 6928 wrote to memory of 2832	6928	s240735953.exe	119
PID 2832 wrote to memory of 2104	2832	cmd.exe	121
PID 2832 wrote to memory of 4228	2832	cmd.exe	122
PID 2832 wrote to memory of 4676	2832	cmd.exe	123
PID 6928 wrote to memory of 6004	6928	s240735953.exe	124
PID 6004 wrote to memory of 3536	6004	cmd.exe	126
PID 6004 wrote to memory of 2476	6004	cmd.exe	127
PID 6004 wrote to memory of 2760	6004	cmd.exe	128
PID 6928 wrote to memory of 6276	6928	s240735953.exe	129
PID 6276 wrote to memory of 3380	6276	cmd.exe	131
PID 6276 wrote to memory of 2176	6276	cmd.exe	132
PID 6276 wrote to memory of 1076	6276	cmd.exe	133
PID 6928 wrote to memory of 2140	6928	s240735953.exe	134
PID 2140 wrote to memory of 6344	2140	cmd.exe	136
PID 2140 wrote to memory of 3040	2140	cmd.exe	137
PID 2140 wrote to memory of 1364	2140	cmd.exe	138
PID 6928 wrote to memory of 5776	6928	s240735953.exe	139
PID 5776 wrote to memory of 5892	5776	cmd.exe	141
PID 5776 wrote to memory of 4660	5776	cmd.exe	142
PID 5776 wrote to memory of 4124	5776	cmd.exe	143
PID 6928 wrote to memory of 2596	6928	s240735953.exe	144
PID 2596 wrote to memory of 5660	2596	cmd.exe	146
PID 6928 wrote to memory of 5476	6928	s240735953.exe	147
PID 5476 wrote to memory of 3976	5476	cmd.exe	149
PID 6928 wrote to memory of 4488	6928	s240735953.exe	150
PID 4488 wrote to memory of 5320	4488	cmd.exe	152
PID 4488 wrote to memory of 5132	4488	cmd.exe	153
PID 4488 wrote to memory of 4292	4488	cmd.exe	154
PID 6928 wrote to memory of 3608	6928	s240735953.exe	155
PID 3608 wrote to memory of 2312	3608	cmd.exe	157
PID 3608 wrote to memory of 6300	3608	cmd.exe	158
PID 3608 wrote to memory of 2300	3608	cmd.exe	159
PID 6928 wrote to memory of 916	6928	s240735953.exe	160
PID 916 wrote to memory of 6196	916	cmd.exe	162
PID 916 wrote to memory of 1948	916	cmd.exe	163
PID 6928 wrote to memory of 5048	6928	s240735953.exe	167
PID 5048 wrote to memory of 4104	5048	cmd.exe	169
PID 6928 wrote to memory of 2224	6928	s240735953.exe	170
PID 2224 wrote to memory of 1384	2224	cmd.exe	172
PID 2224 wrote to memory of 704	2224	cmd.exe	173
PID 2224 wrote to memory of 2632	2224	cmd.exe	174
PID 6928 wrote to memory of 1688	6928	s240735953.exe	175
PID 1688 wrote to memory of 1912	1688	cmd.exe	177
PID 1688 wrote to memory of 944	1688	cmd.exe	178
PID 1688 wrote to memory of 5860	1688	cmd.exe	179
PID 6928 wrote to memory of 6904	6928	s240735953.exe	180

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-15_19585609c3422d89b43fa137097e3ca0_icedid_njrat_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_19585609c3422d89b43fa137097e3ca0_icedid_njrat_quasar-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6100
- C:\Users\Admin\AppData\Local\Temp\s240735953.exe
  "C:\Users\Admin\AppData\Local\Temp\s240735953.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks processor information in registry
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:6928
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c cscript /nologo "C:\Users\Admin\AppData\Local\Temp\mk.vbs"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5656
  - - C:\Windows\system32\cscript.exe
      cscript /nologo "C:\Users\Admin\AppData\Local\Temp\mk.vbs"
      4⤵
      Creates a file in the Startup directory
      Executes a VBScript file via the Windows Script Host.
      PID:5772
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c schtasks /create /tn "Microsoft\SpotifyHelper" /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\SpotifyHelper\SpotifyHelper.exe\"" /sc ONLOGON /rl HIGHEST /f 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5648
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "Microsoft\SpotifyHelper" /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\SpotifyHelper\SpotifyHelper.exe\"" /sc ONLOGON /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3492
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6700
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6188
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:3404
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:4508
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1216
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4416
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:4312
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:4872
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6520
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3972
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:2992
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:5036
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:2104
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:4228
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:4676
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6004
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:3536
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:2476
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:2760
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6276
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:3380
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:2176
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:1076
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:6344
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:3040
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:1364
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5776
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:5892
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:4660
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:4124
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c netsh wlan show profiles 2>nul
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5660
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c reg query "HKCU\Software\Microsoft\Office\16.0\Outlook\Profiles" /s 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5476
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Office\16.0\Outlook\Profiles" /s
      4⤵
      Accesses Microsoft Outlook profiles
      outlook_office_path
      PID:3976
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:5320
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:5132
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:4292
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:2312
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:6300
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:2300
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic product get name,version 2>nul | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:916
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version
      4⤵
      PID:6196
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:1948
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ipconfig /all 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5048
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:4104
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:1384
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:704
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:2632
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:1912
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:944
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:5860
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:6904
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:5344
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:5448
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:5876
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:3308
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:5816
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:5316
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:1680
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:2628
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:1240
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:5336
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:5252
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:256
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:4332
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:4520
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:5480
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:4740
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:6572
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:3352
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:6748
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:6396
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:4444
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:6564
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:6408
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:6172
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:6368
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:3828
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:4228
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:5924
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:1172
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:3600
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:6788
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:6696
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:1760
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:5044
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:3380
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:2500
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:7112
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:6484
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:2756
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:6324
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:4276
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:1736
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:5008
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:4940
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:6736
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:2864
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:5444
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:3856
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:5272
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:1244
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:5132
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:6284
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:6300
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:6432
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:4920
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:1020
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:5796
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:6900
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:5812
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:1480
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:6552
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:6488
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:3796
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:4268
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:2972
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:3832
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:3540
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:6960
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:1636
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:4308
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:5824
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:5520
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:700
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:1948
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:6164
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:5472
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:5792
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:3528
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:2636
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:3488
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:4788
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:4252
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:6796
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:1952
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:4748
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:5224
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:4724
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:5876
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:1932
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:2360
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:6632
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:1228
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:4856
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:4188
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:4348
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:6608
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:124
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:3168
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:2704
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:3020
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:6940
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:4332
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:4520
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:4240
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:6428
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:6572
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:2440
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:6548
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:4444
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:2992
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:6408
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:6280
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:2104
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:2560
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:7108
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:6208
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:4400
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:5932
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:7012
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:2072
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:6612
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:2176
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:2688
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:1556
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:6308
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:1316
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:620
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:2920
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:5896
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:5604
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:1736
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:3248
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:3000
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:2864
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:6660
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName 2>nul | findstr /v displayName | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:5132
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      PID:2724
  - - C:\Windows\system32\findstr.exe
      findstr /v displayName
      4⤵
      PID:3512
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:4132
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic path win32_videocontroller get name 2>nul | findstr /v Name | findstr /v /r "^$"
    3⤵
    - Executes a command shell one-liner
    PID:3392
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      PID:1892
  - - C:\Windows\system32\findstr.exe
      findstr /v Name
      4⤵
      PID:4196
  - - C:\Windows\system32\findstr.exe
      findstr /v /r "^$"
      4⤵
      PID:6804
- C:\Users\Admin\AppData\Local\Temp\a240735953.exe
  "C:\Users\Admin\AppData\Local\Temp\a240735953.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3324

C:\Users\Admin\AppData\Roaming\Microsoft\SpotifyHelper\SpotifyHelper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\SpotifyHelper\SpotifyHelper.exe"
1⤵
- Executes dropped EXE
PID:7152

C:\Users\Admin\AppData\Roaming\Microsoft\SpotifyHelper\SpotifyHelper.exe
C:\Users\Admin\AppData\Roaming\Microsoft\SpotifyHelper\SpotifyHelper.exe
1⤵
- Executes dropped EXE
PID:6628

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of SetWindowsHookEx
PID:1884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery