Analysis

  • max time kernel
    52s
  • max time network
    50s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    12/11/2024, 13:50

General

  • Target

    applecleaner_2.exe

  • Size

    3.6MB

  • MD5

    f96eb2236970fb3ea97101b923af4228

  • SHA1

    e0eed80f1054acbf5389a7b8860a4503dd3e184a

  • SHA256

    46fe5192387d3f897a134d29c069ebf39c72094c892134d2f0e77b12b11a6172

  • SHA512

    2fd2d28c5f571d40b43a4dd7a22d367ba42420c29627f21ca0a2052070ffb9f689d80dad638238189eed26ed19af626f47e70f1207e10007041c620dac323cc7

  • SSDEEP

    98304:z7m+ij9HD0+jCihNRkl/W6aG/wcKnfu8NUT6Ko:e+y4ihkl/Wo/afHPb

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 7 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

  • Checks system information in the registry 2 TTPs 1 IoCs

    System information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 21 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Enumerates system info in registry 2 TTPs 21 IoCs
  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\applecleaner_2.exe
    "C:\Users\Admin\AppData\Local\Temp\applecleaner_2.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Checks system information in the registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4664
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c taskkill /f /im EpicGamesLauncher.exe >nul 2>&1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3700
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im EpicGamesLauncher.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:960
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:1324
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im FortniteClient-Win64-Shipping.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:380
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c taskkill /f /im Battle.net.exe >nul 2>&1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3716
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im Battle.net.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3204
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start https://applecheats.cc
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4772
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://applecheats.cc/
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1392
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x140,0x150,0x7ffc1a5146f8,0x7ffc1a514708,0x7ffc1a514718
          4⤵
            PID:3128
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,10724839514403051431,5097955282474898146,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
            4⤵
              PID:1056
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,10724839514403051431,5097955282474898146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:3956
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,10724839514403051431,5097955282474898146,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
              4⤵
                PID:3712
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10724839514403051431,5097955282474898146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
                4⤵
                  PID:2876
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10724839514403051431,5097955282474898146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
                  4⤵
                    PID:2940
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10724839514403051431,5097955282474898146,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4296 /prefetch:1
                    4⤵
                      PID:3544
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10724839514403051431,5097955282474898146,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
                      4⤵
                        PID:4024
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10724839514403051431,5097955282474898146,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
                        4⤵
                          PID:1076
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10724839514403051431,5097955282474898146,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
                          4⤵
                            PID:2860
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10724839514403051431,5097955282474898146,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
                            4⤵
                              PID:5056
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10724839514403051431,5097955282474898146,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
                              4⤵
                                PID:3284
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10724839514403051431,5097955282474898146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
                                4⤵
                                  PID:4312
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10724839514403051431,5097955282474898146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
                                  4⤵
                                    PID:1104
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10724839514403051431,5097955282474898146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
                                    4⤵
                                      PID:4840
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                                      4⤵
                                      • Drops file in Program Files directory
                                      PID:5564
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x130,0x134,0x138,0x170,0x174,0x7ff6f1a15460,0x7ff6f1a15470,0x7ff6f1a15480
                                        5⤵
                                          PID:5608
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,10724839514403051431,5097955282474898146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7320 /prefetch:8
                                        4⤵
                                          PID:5572
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,10724839514403051431,5097955282474898146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7320 /prefetch:8
                                          4⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:5880
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10724839514403051431,5097955282474898146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7680 /prefetch:1
                                          4⤵
                                            PID:5380
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10724839514403051431,5097955282474898146,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7428 /prefetch:1
                                            4⤵
                                              PID:4312
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10724839514403051431,5097955282474898146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
                                              4⤵
                                                PID:5760
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10724839514403051431,5097955282474898146,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
                                                4⤵
                                                  PID:5724
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10724839514403051431,5097955282474898146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7764 /prefetch:1
                                                  4⤵
                                                    PID:4848
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c pause
                                                2⤵
                                                  PID:3104
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c cls
                                                  2⤵
                                                    PID:3316
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c NETSH WINSOCK RESET >nul 2>&1
                                                    2⤵
                                                      PID:4944
                                                      • C:\Windows\system32\netsh.exe
                                                        NETSH WINSOCK RESET
                                                        3⤵
                                                        • Event Triggered Execution: Netsh Helper DLL
                                                        PID:1336
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c NETSH INT IP RESET >nul 2>&1
                                                      2⤵
                                                        PID:3620
                                                        • C:\Windows\system32\netsh.exe
                                                          NETSH INT IP RESET
                                                          3⤵
                                                          • Event Triggered Execution: Netsh Helper DLL
                                                          PID:4324
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c netsh advfirewall reset >nul 2>&1
                                                        2⤵
                                                          PID:2836
                                                          • C:\Windows\system32\netsh.exe
                                                            netsh advfirewall reset
                                                            3⤵
                                                            • Modifies Windows Firewall
                                                            • Event Triggered Execution: Netsh Helper DLL
                                                            PID:5056
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c NETSH INTERFACE IPV4 RESET >nul 2>&1
                                                          2⤵
                                                            PID:4752
                                                            • C:\Windows\system32\netsh.exe
                                                              NETSH INTERFACE IPV4 RESET
                                                              3⤵
                                                              • Event Triggered Execution: Netsh Helper DLL
                                                              PID:2104
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c NETSH INTERFACE IPV6 RESET >nul 2>&1
                                                            2⤵
                                                              PID:2700
                                                              • C:\Windows\system32\netsh.exe
                                                                NETSH INTERFACE IPV6 RESET
                                                                3⤵
                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                PID:1624
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c NETSH INTERFACE TCP RESET >nul 2>&1
                                                              2⤵
                                                                PID:4488
                                                                • C:\Windows\system32\netsh.exe
                                                                  NETSH INTERFACE TCP RESET
                                                                  3⤵
                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                  PID:4008
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c NETSH INT RESET ALL >nul 2>&1
                                                                2⤵
                                                                  PID:2860
                                                                  • C:\Windows\system32\netsh.exe
                                                                    NETSH INT RESET ALL
                                                                    3⤵
                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                    PID:4992
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c IPCONFIG /RELEASE >nul 2>&1
                                                                  2⤵
                                                                    PID:5404
                                                                    • C:\Windows\system32\ipconfig.exe
                                                                      IPCONFIG /RELEASE
                                                                      3⤵
                                                                      • Gathers network information
                                                                      PID:5456
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c IPCONFIG /RELEASE >nul 2>&1
                                                                    2⤵
                                                                      PID:3900
                                                                      • C:\Windows\system32\ipconfig.exe
                                                                        IPCONFIG /RELEASE
                                                                        3⤵
                                                                        • Gathers network information
                                                                        PID:3576
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c IPCONFIG /FLUSHDNS >nul 2>&1
                                                                      2⤵
                                                                        PID:5432
                                                                        • C:\Windows\system32\ipconfig.exe
                                                                          IPCONFIG /FLUSHDNS
                                                                          3⤵
                                                                          • Gathers network information
                                                                          PID:5416
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c NBTSTAT -R >nul 2>&1
                                                                        2⤵
                                                                          PID:5440
                                                                          • C:\Windows\system32\nbtstat.exe
                                                                            NBTSTAT -R
                                                                            3⤵
                                                                              PID:4312
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c NBTSTAT -RR >nul 2>&1
                                                                            2⤵
                                                                              PID:5188
                                                                              • C:\Windows\system32\nbtstat.exe
                                                                                NBTSTAT -RR
                                                                                3⤵
                                                                                  PID:3488
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c arp -a >nul 2>&1
                                                                                2⤵
                                                                                • Network Service Discovery
                                                                                PID:384
                                                                                • C:\Windows\system32\ARP.EXE
                                                                                  arp -a
                                                                                  3⤵
                                                                                  • Network Service Discovery
                                                                                  PID:1704
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c arp -d >nul 2>&1
                                                                                2⤵
                                                                                  PID:2520
                                                                                  • C:\Windows\system32\ARP.EXE
                                                                                    arp -d
                                                                                    3⤵
                                                                                      PID:5128
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c WMIC PATH WIN32_NETWORKADAPTER WHERE PHYSICALADAPTER=TRUE CALL DISABLE >nul 2>&1
                                                                                    2⤵
                                                                                      PID:2612
                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                        WMIC PATH WIN32_NETWORKADAPTER WHERE PHYSICALADAPTER=TRUE CALL DISABLE
                                                                                        3⤵
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:5152
                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                    1⤵
                                                                                      PID:1828
                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                      1⤵
                                                                                        PID:928

                                                                                      Network

                                                                                            MITRE ATT&CK Enterprise v15

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                              Filesize

                                                                                              152B

                                                                                              MD5

                                                                                              d9a93ee5221bd6f61ae818935430ccac

                                                                                              SHA1

                                                                                              f35db7fca9a0204cefc2aef07558802de13f9424

                                                                                              SHA256

                                                                                              a756ec37aec7cd908ea1338159800fd302481acfddad3b1701c399a765b7c968

                                                                                              SHA512

                                                                                              b47250fdd1dd86ad16843c3df5bed88146c29279143e20f51af51f5a8d9481ae655db675ca31801e98ab1b82b01cb87ae3c83b6e68af3f7835d3cfa83100ad44

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                              Filesize

                                                                                              48B

                                                                                              MD5

                                                                                              f5f20650baeff88c4ed6043b339a450a

                                                                                              SHA1

                                                                                              c1e9fb38488a17257c3fb9f5c4ccdafeca79cf34

                                                                                              SHA256

                                                                                              4416e3e746ac12378cf4c6963cbd4d28aaeb7bc3febce7fbc32aefd4e2623d16

                                                                                              SHA512

                                                                                              a5b140803951ee219be0f30e9bcc58a794e8ae1884280faf8b68fa8564392381cb4e5a2114b3c5f7f4d3ffe0570c9e44e3da41ade2f6cbf2dda6579a1b9e2f2d

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                              Filesize

                                                                                              120B

                                                                                              MD5

                                                                                              ccf555801e29147130c625c47a774250

                                                                                              SHA1

                                                                                              86782cfb1d5eda4894c2f1073b4631772d9ad9ee

                                                                                              SHA256

                                                                                              e03ae91eb17e922b4e4c26fcdc6b1268181f7b6bf309fa9203a72291ef0b9afc

                                                                                              SHA512

                                                                                              986effb5adce9e63f420e542c473e67f5c3f1df27e58efe193a97f2068ef7071c77d418577e284d568cacfef4a73891b3fdf082da0057bbd3fdcd04f69abe03f

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

                                                                                              Filesize

                                                                                              70KB

                                                                                              MD5

                                                                                              e5e3377341056643b0494b6842c0b544

                                                                                              SHA1

                                                                                              d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                                                                              SHA256

                                                                                              e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                                                                              SHA512

                                                                                              83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                              Filesize

                                                                                              4KB

                                                                                              MD5

                                                                                              5dc51ec96bc117ec089a059fb0590864

                                                                                              SHA1

                                                                                              12be6ab6cc8957425f80fc780ab35d3e2eaefc1b

                                                                                              SHA256

                                                                                              22c8b460de1350bfb68658052421fb33729f67709c085bf94aa1b2c0a6959fd3

                                                                                              SHA512

                                                                                              dc65513968fe27d7b03844d28e8d204e8f0f7c9d644567b874843fd8c74722916066f78b8027cd806d6673cc68d5dfd7f51fe866c482551bce4f02eb7c2c74f3

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                              Filesize

                                                                                              5KB

                                                                                              MD5

                                                                                              730cdc14e5103cc9e8c9b8a25850ece6

                                                                                              SHA1

                                                                                              95f8f44573bdd4f18069e2735ff16da8f6062577

                                                                                              SHA256

                                                                                              8fe783b10c049c44379993b28ada1859eef1e2dfc5654f4567fd552d21f7c70a

                                                                                              SHA512

                                                                                              2e462c38b5f88805f80ec6eb086e6dc4a57a23eea8677164eedbdacb05794dcbb1091693ec6fb6d15df0cc7d903550145a53bcf8e2bbaa533c0173019a53ae45

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                              Filesize

                                                                                              5KB

                                                                                              MD5

                                                                                              036ec7d3a5926495710e072977a14e52

                                                                                              SHA1

                                                                                              22940773e8a5b04726a30769df5f55bc46a8415b

                                                                                              SHA256

                                                                                              b367a8ee337cda2330fd6142964a386f44d09743710abcd221ac64050eb05ede

                                                                                              SHA512

                                                                                              9b7b009d0983ba496c543af741b0672e554b8fc172c2d4b45cd7237c6b12a473ff7da1543c732c7f6bc1c887be6065532e6f34a6544ebbeabe480d11928a8217

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                              Filesize

                                                                                              24KB

                                                                                              MD5

                                                                                              10270349f779429de28162817ffc068a

                                                                                              SHA1

                                                                                              4a78058739622bd517a9e9c76c63698c999e7262

                                                                                              SHA256

                                                                                              69ccd3088b7246603650445d453973c77cab05cd79d3143fa7714a2f31e9d1ec

                                                                                              SHA512

                                                                                              678073d7600f9123fdd450b1b223c668942342633b14a2f5d97126a38c212e5c8e8df4e20fa51453f2bfb06296881accf5fe1730c657e3f52c995311ba21985d

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                              Filesize

                                                                                              24KB

                                                                                              MD5

                                                                                              1b79da0d7c88b86a0c63f32044ec9d92

                                                                                              SHA1

                                                                                              281cbcbe2815b9b3621a012f4fe978857a797373

                                                                                              SHA256

                                                                                              4b0846ad2b8613c619592eb89a2474e1ee1f6d94ebdf153078d6ff2064a8f06f

                                                                                              SHA512

                                                                                              390f2f3b54595e885da4a6e24d495f4d199a4c8c17776734597ffa9d68e7852c08f5afb2ac671f45f3dc2ed5ab6c66fdb8ea0ad3e868bc8c8d32685d1e6ee964

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

                                                                                              Filesize

                                                                                              8KB

                                                                                              MD5

                                                                                              cf89d16bb9107c631daabf0c0ee58efb

                                                                                              SHA1

                                                                                              3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                                                                                              SHA256

                                                                                              d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                                                                                              SHA512

                                                                                              8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

                                                                                              Filesize

                                                                                              264KB

                                                                                              MD5

                                                                                              f50f89a0a91564d0b8a211f8921aa7de

                                                                                              SHA1

                                                                                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                              SHA256

                                                                                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                              SHA512

                                                                                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

                                                                                              Filesize

                                                                                              8KB

                                                                                              MD5

                                                                                              0962291d6d367570bee5454721c17e11

                                                                                              SHA1

                                                                                              59d10a893ef321a706a9255176761366115bedcb

                                                                                              SHA256

                                                                                              ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                                                                                              SHA512

                                                                                              f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

                                                                                              Filesize

                                                                                              8KB

                                                                                              MD5

                                                                                              41876349cb12d6db992f1309f22df3f0

                                                                                              SHA1

                                                                                              5cf26b3420fc0302cd0a71e8d029739b8765be27

                                                                                              SHA256

                                                                                              e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                                                                                              SHA512

                                                                                              e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT

                                                                                              Filesize

                                                                                              16B

                                                                                              MD5

                                                                                              46295cac801e5d4857d09837238a6394

                                                                                              SHA1

                                                                                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                              SHA256

                                                                                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                              SHA512

                                                                                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                              Filesize

                                                                                              16B

                                                                                              MD5

                                                                                              206702161f94c5cd39fadd03f4014d98

                                                                                              SHA1

                                                                                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                              SHA256

                                                                                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                              SHA512

                                                                                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

                                                                                              Filesize

                                                                                              41B

                                                                                              MD5

                                                                                              5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                              SHA1

                                                                                              d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                              SHA256

                                                                                              f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                              SHA512

                                                                                              de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                              Filesize

                                                                                              8KB

                                                                                              MD5

                                                                                              5feb527f2b69fa66683cce76e7349842

                                                                                              SHA1

                                                                                              04c93ad308a0acf5960c08537335731f5d39afae

                                                                                              SHA256

                                                                                              ce3846e0fb2f0108fad1b08cae92ec97ad7e14d993642342e133aa09388dccef

                                                                                              SHA512

                                                                                              e5c6685dbc0a187afcf8d708599c067fbbbfbcde046853a9a762ebb0742e043c8f35a7a2ef9713377d27b77a3bcf5c86d1433e8ec117ffa605233df0eda00cb2

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                              Filesize

                                                                                              10KB

                                                                                              MD5

                                                                                              7183607ad2572d58d85121485c171036

                                                                                              SHA1

                                                                                              199a956a634009381fec7ed6b0706525393ec10e

                                                                                              SHA256

                                                                                              138533120d56dc08c7fcadb8a85331b491adc6129b8fe9ae7dbc74bfde59b36f

                                                                                              SHA512

                                                                                              b9fd5ae6a471d52ed919532ed0eb4c37df0bd2bf08c0a264819a5c9b810bfcad254502a76af7ad1dd725cf699a53b97e5d0db049e79035b8a4f26567f1754c62

                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                                                              Filesize

                                                                                              3KB

                                                                                              MD5

                                                                                              3cbac8c94701b767bacc693b8199d49e

                                                                                              SHA1

                                                                                              d7b3be66df3a596afbc6d506b1bc3fd1349d49d2

                                                                                              SHA256

                                                                                              09fba107d66fa7584a7f0e5ae24e0b65eece9084ae5879123586fdde44336def

                                                                                              SHA512

                                                                                              8411c924e79ac39820e4a96a74d66619baa9335f069b901d4832561d354cc37724e4e2d3bf451413ccbf95f6bb330f7e433857a878b7748c1f98d26b4971a32e

                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                                                              Filesize

                                                                                              3KB

                                                                                              MD5

                                                                                              dea5116f8c2d51b2f8d11e41716e904e

                                                                                              SHA1

                                                                                              a1e7a4daed6843e8e5d35b7fa8a4ab6048a9725f

                                                                                              SHA256

                                                                                              9aaad039dae31e6abda36b69e59cfd746c93947ac170bea6f3826d101808c66c

                                                                                              SHA512

                                                                                              0ce5b769723d56234a09819d9ec8474b633d2bf17402e1b02c26fca6afb2fe2c10d808d1a804baa851cb383b6e26db2ecdb4f854368391a06f75e6252e278441

                                                                                            • memory/4664-0-0x00007FF6C8E70000-0x00007FF6C9812000-memory.dmp

                                                                                              Filesize

                                                                                              9.6MB

                                                                                            • memory/4664-140-0x00007FF6C8E70000-0x00007FF6C9812000-memory.dmp

                                                                                              Filesize

                                                                                              9.6MB

                                                                                            • memory/4664-5-0x00007FF6C8E70000-0x00007FF6C9812000-memory.dmp

                                                                                              Filesize

                                                                                              9.6MB

                                                                                            • memory/4664-2-0x00007FF6C8E70000-0x00007FF6C9812000-memory.dmp

                                                                                              Filesize

                                                                                              9.6MB

                                                                                            • memory/4664-4-0x00007FF6C8E70000-0x00007FF6C9812000-memory.dmp

                                                                                              Filesize

                                                                                              9.6MB

                                                                                            • memory/4664-3-0x00007FF6C8E70000-0x00007FF6C9812000-memory.dmp

                                                                                              Filesize

                                                                                              9.6MB

                                                                                            • memory/4664-6-0x00007FF6C8E70000-0x00007FF6C9812000-memory.dmp

                                                                                              Filesize

                                                                                              9.6MB

                                                                                            • memory/4664-1-0x00007FFC39211000-0x00007FFC39213000-memory.dmp

                                                                                              Filesize

                                                                                              8KB