xmrig | cfa74acf53afaa2fd61de7ef079cdc4a33dbff99c9f4a93d49570d4aaf52b8e2

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 12:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6b0241a7c15a54f66ef753d8a6cdfb49_JaffaCakes118.exe
Size 524KB
Sample240523-p56pasbd95
SHA256 cfa74acf53afaa2fd61de7ef079cdc4a33dbff99c9f4a93d49570d4aaf52b8e2
MD5 6b0241a7c15a54f66ef753d8a6cdfb49
SHA1 77934b75c9772140fddf10b051134582b0609665
SHA512 ea92a80b221721c37cf643c17d8c4251109314cfff85f454c5b6be5055e3a1ffc0a5466b79329147745fa737d3559169565cb64e5333b7e4e2477175e3f80867
SSDEEP 12288:KgIdCFdSZHZZQEnI0qoXKvawR0driSKUdWLlERv3NyvJqD:BYYSZ5ZQNiKvawRpAdQER/NyvED
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner persistence

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral2/files/0x00080000000233ec-8.dat	xmrig

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	system32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	6b0241a7c15a54f66ef753d8a6cdfb49_JaffaCakes118.exe

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Executes dropped EXE 2 IoCs

pid	Process
4208	system32.exe
4160	esif.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Intel(R) Dynamic Platform = "\"C:\\ProgramData\\ServiceProfiles\\esif.exe\""	esif.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
58	iplogger.com
59	iplogger.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\System32	6b0241a7c15a54f66ef753d8a6cdfb49_JaffaCakes118.exe
File created	C:\Program Files (x86)\System32\__tmp_rar_sfx_access_check_240599921	6b0241a7c15a54f66ef753d8a6cdfb49_JaffaCakes118.exe
File created	C:\Program Files (x86)\System32\system32.exe	6b0241a7c15a54f66ef753d8a6cdfb49_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\System32\system32.exe	6b0241a7c15a54f66ef753d8a6cdfb49_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
5364	tasklist.exe
5804	tasklist.exe
5264	tasklist.exe
2828	tasklist.exe
4280	tasklist.exe
3504	tasklist.exe
4240	tasklist.exe
5500	tasklist.exe
4752	tasklist.exe
5820	tasklist.exe
3572	tasklist.exe
2612	tasklist.exe
1740	tasklist.exe
1740	tasklist.exe
2956	tasklist.exe
468	tasklist.exe
6104	tasklist.exe
5852	tasklist.exe
3520	tasklist.exe
2648	tasklist.exe
6128	tasklist.exe
2956	tasklist.exe
2756	tasklist.exe
2340	tasklist.exe
5440	tasklist.exe
5428	tasklist.exe
2376	tasklist.exe
3304	tasklist.exe
3720	tasklist.exe
5312	tasklist.exe
948	tasklist.exe
5584	tasklist.exe
4076	tasklist.exe
4644	tasklist.exe
5572	tasklist.exe
1620	tasklist.exe
5380	tasklist.exe
5272	tasklist.exe
5880	tasklist.exe
3808	tasklist.exe
3580	tasklist.exe
4216	tasklist.exe
5260	tasklist.exe
5380	tasklist.exe
5600	tasklist.exe
4532	tasklist.exe
4532	tasklist.exe
5320	tasklist.exe
4252	tasklist.exe
2036	tasklist.exe
3712	tasklist.exe
3836	tasklist.exe
3604	tasklist.exe
1632	tasklist.exe
4372	tasklist.exe
4520	tasklist.exe
5344	tasklist.exe
5440	tasklist.exe
4608	tasklist.exe
5300	tasklist.exe
2864	tasklist.exe
2352	tasklist.exe
5348	tasklist.exe
3500	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
1400	PING.EXE
5588	PING.EXE
4328	PING.EXE
2240	PING.EXE
1056	PING.EXE
2916	PING.EXE
6128	PING.EXE
5508	PING.EXE
5776	PING.EXE
4980	PING.EXE
3720	PING.EXE
1460	PING.EXE
4044	PING.EXE
2700	PING.EXE
6088	PING.EXE
8	PING.EXE
4152	PING.EXE
5232	PING.EXE
3520	PING.EXE
5128	PING.EXE
2624	PING.EXE
5264	PING.EXE
4244	PING.EXE
6140	PING.EXE
1096	PING.EXE
5248	PING.EXE
3504	PING.EXE
5804	PING.EXE
3880	PING.EXE
1752	PING.EXE
4040	PING.EXE
5500	PING.EXE
5396	PING.EXE
3224	PING.EXE
5796	PING.EXE
5232	PING.EXE
2936	PING.EXE
3260	PING.EXE
516	PING.EXE
5508	PING.EXE
5924	PING.EXE
3640	PING.EXE
5488	PING.EXE
1060	PING.EXE
4268	PING.EXE
3572	PING.EXE
6092	PING.EXE
6080	PING.EXE
852	PING.EXE
5416	PING.EXE
5544	PING.EXE
3128	PING.EXE
5152	PING.EXE
5324	PING.EXE
5836	PING.EXE
4180	PING.EXE
4696	PING.EXE
2652	PING.EXE
5164	PING.EXE
5812	PING.EXE
2828	PING.EXE
2756	PING.EXE
5160	PING.EXE
5392	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
1584	msedge.exe
1584	msedge.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe
4160	esif.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3836	tasklist.exe
Token: SeLockMemoryPrivilege	4160	esif.exe
Token: SeLockMemoryPrivilege	4160	esif.exe
Token: SeDebugPrivilege	872	tasklist.exe
Token: SeDebugPrivilege	948	tasklist.exe
Token: SeDebugPrivilege	5408	tasklist.exe
Token: SeDebugPrivilege	5544	tasklist.exe
Token: SeDebugPrivilege	5792	tasklist.exe
Token: SeDebugPrivilege	5880	tasklist.exe
Token: SeDebugPrivilege	6064	tasklist.exe
Token: SeDebugPrivilege	1740	tasklist.exe
Token: SeDebugPrivilege	3604	tasklist.exe
Token: SeDebugPrivilege	5440	tasklist.exe
Token: SeDebugPrivilege	4932	tasklist.exe
Token: SeDebugPrivilege	436	tasklist.exe
Token: SeDebugPrivilege	5584	tasklist.exe
Token: SeDebugPrivilege	5180	tasklist.exe
Token: SeDebugPrivilege	5264	tasklist.exe
Token: SeDebugPrivilege	5600	tasklist.exe
Token: SeDebugPrivilege	5848	tasklist.exe
Token: SeDebugPrivilege	5868	tasklist.exe
Token: SeDebugPrivilege	6068	tasklist.exe
Token: SeDebugPrivilege	5316	tasklist.exe
Token: SeDebugPrivilege	2596	tasklist.exe
Token: SeDebugPrivilege	1564	tasklist.exe
Token: SeDebugPrivilege	5428	tasklist.exe
Token: SeDebugPrivilege	3280	tasklist.exe
Token: SeDebugPrivilege	5520	tasklist.exe
Token: SeDebugPrivilege	5152	tasklist.exe
Token: SeDebugPrivilege	5276	tasklist.exe
Token: SeDebugPrivilege	4520	tasklist.exe
Token: SeDebugPrivilege	5820	tasklist.exe
Token: SeDebugPrivilege	5944	tasklist.exe
Token: SeDebugPrivilege	4532	tasklist.exe
Token: SeDebugPrivilege	4696	tasklist.exe
Token: SeDebugPrivilege	5344	tasklist.exe
Token: SeDebugPrivilege	5416	tasklist.exe
Token: SeDebugPrivilege	2352	tasklist.exe
Token: SeDebugPrivilege	5500	tasklist.exe
Token: SeDebugPrivilege	5636	tasklist.exe
Token: SeDebugPrivilege	5184	tasklist.exe
Token: SeDebugPrivilege	5028	tasklist.exe
Token: SeDebugPrivilege	5596	tasklist.exe
Token: SeDebugPrivilege	5840	tasklist.exe
Token: SeDebugPrivilege	5272	tasklist.exe
Token: SeDebugPrivilege	6104	tasklist.exe
Token: SeDebugPrivilege	228	tasklist.exe
Token: SeDebugPrivilege	6088	tasklist.exe
Token: SeDebugPrivilege	2972	tasklist.exe
Token: SeDebugPrivilege	5364	tasklist.exe
Token: SeDebugPrivilege	3572	tasklist.exe
Token: SeDebugPrivilege	2956	tasklist.exe
Token: SeDebugPrivilege	5440	tasklist.exe
Token: SeDebugPrivilege	2612	tasklist.exe
Token: SeDebugPrivilege	5960	tasklist.exe
Token: SeDebugPrivilege	5508	tasklist.exe
Token: SeDebugPrivilege	5780	tasklist.exe
Token: SeDebugPrivilege	1988	tasklist.exe
Token: SeDebugPrivilege	5804	tasklist.exe
Token: SeDebugPrivilege	5812	tasklist.exe
Token: SeDebugPrivilege	5852	tasklist.exe
Token: SeDebugPrivilege	1812	tasklist.exe
Token: SeDebugPrivilege	4532	tasklist.exe
Token: SeDebugPrivilege	6140	tasklist.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 2620	4700	6b0241a7c15a54f66ef753d8a6cdfb49_JaffaCakes118.exe	83
PID 4700 wrote to memory of 2620	4700	6b0241a7c15a54f66ef753d8a6cdfb49_JaffaCakes118.exe	83
PID 4700 wrote to memory of 2620	4700	6b0241a7c15a54f66ef753d8a6cdfb49_JaffaCakes118.exe	83
PID 4700 wrote to memory of 4208	4700	6b0241a7c15a54f66ef753d8a6cdfb49_JaffaCakes118.exe	85
PID 4700 wrote to memory of 4208	4700	6b0241a7c15a54f66ef753d8a6cdfb49_JaffaCakes118.exe	85
PID 2620 wrote to memory of 1584	2620	cmd.exe	88
PID 2620 wrote to memory of 1584	2620	cmd.exe	88
PID 1584 wrote to memory of 3176	1584	msedge.exe	89
PID 1584 wrote to memory of 3176	1584	msedge.exe	89
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2188	1584	msedge.exe	90
PID 1584 wrote to memory of 2104	1584	msedge.exe	91
PID 1584 wrote to memory of 2104	1584	msedge.exe	91
PID 1584 wrote to memory of 1672	1584	msedge.exe	92
PID 1584 wrote to memory of 1672	1584	msedge.exe	92
PID 1584 wrote to memory of 1672	1584	msedge.exe	92
PID 1584 wrote to memory of 1672	1584	msedge.exe	92
PID 1584 wrote to memory of 1672	1584	msedge.exe	92
PID 1584 wrote to memory of 1672	1584	msedge.exe	92
PID 1584 wrote to memory of 1672	1584	msedge.exe	92
PID 1584 wrote to memory of 1672	1584	msedge.exe	92
PID 1584 wrote to memory of 1672	1584	msedge.exe	92
PID 1584 wrote to memory of 1672	1584	msedge.exe	92
PID 1584 wrote to memory of 1672	1584	msedge.exe	92
PID 1584 wrote to memory of 1672	1584	msedge.exe	92
PID 1584 wrote to memory of 1672	1584	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\6b0241a7c15a54f66ef753d8a6cdfb49_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6b0241a7c15a54f66ef753d8a6cdfb49_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "start http://lospollos.com?r=33773718"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://lospollos.com/?r=33773718
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeea5046f8,0x7ffeea504708,0x7ffeea504718
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,9482803385925175061,4151612275499777267,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
      4⤵
      PID:2188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,9482803385925175061,4151612275499777267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,9482803385925175061,4151612275499777267,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
      4⤵
      PID:1672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9482803385925175061,4151612275499777267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
      4⤵
      PID:3740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9482803385925175061,4151612275499777267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
      4⤵
      PID:3672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9482803385925175061,4151612275499777267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
      4⤵
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,9482803385925175061,4151612275499777267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4528 /prefetch:8
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,9482803385925175061,4151612275499777267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4528 /prefetch:8
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9482803385925175061,4151612275499777267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
      4⤵
      PID:3128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9482803385925175061,4151612275499777267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9482803385925175061,4151612275499777267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9482803385925175061,4151612275499777267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
      4⤵
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,9482803385925175061,4151612275499777267,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5512 /prefetch:2
      4⤵
      PID:2844
- C:\Program Files (x86)\System32\system32.exe
  "C:\Program Files (x86)\System32\system32.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4208
- - C:\ProgramData\ServiceProfiles\esif.exe
    "C:\ProgramData\ServiceProfiles\esif.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ProgramData\cmd.bat" "
    3⤵
    PID:4032
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3836
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4832
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:4040
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:872
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4624
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:2756
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:948
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4408
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:2484
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5408
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5416
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5500
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5544
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5552
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5588
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5792
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5800
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5836
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5880
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5888
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5924
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6064
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:6072
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:6128
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1740
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4640
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:2596
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3604
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4080
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:1400
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5440
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5420
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:1688
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4932
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4668
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:1684
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:436
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:2536
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5508
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5584
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5544
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5160
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5180
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5772
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5232
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5264
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5776
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:3260
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5600
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5604
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5796
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5848
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5856
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5900
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5868
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5936
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:6096
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6068
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:6092
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:6056
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5316
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4440
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:4636
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2596
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:2376
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:3572
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1564
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:60
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:1460
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5428
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5440
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:752
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3280
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4932
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:3520
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5520
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:436
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5560
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5152
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5164
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5276
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5232
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5776
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4520
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5804
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5588
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5820
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5916
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5852
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5944
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5924
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:6124
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4532
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:6088
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:6140
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4696
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:1740
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:4640
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5344
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:516
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:3792
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5416
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5372
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5396
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2352
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:1132
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5504
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5500
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:2696
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:4044
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5636
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5508
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:1096
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5184
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5772
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5256
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5028
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4256
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:1056
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5596
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5592
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5616
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5840
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5920
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5544
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5272
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5284
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:4980
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6104
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5936
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:3500
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:228
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:2368
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:6092
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6088
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5068
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:6056
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2972
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:2432
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5248
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5364
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:3836
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:1664
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3572
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:440
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5392
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2956
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:2604
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:1400
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5440
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5452
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:8
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2612
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5576
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:3476
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5960
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4128
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5560
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5508
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5652
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:1096
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5780
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5184
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5232
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1988
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:2080
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:3504
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5804
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:3260
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:1104
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5812
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5912
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:2180
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5852
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5888
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:6080
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1812
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:2036
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:228
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4532
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:6072
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:2936
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6140
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:2624
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:980
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5340
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5248
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:4640
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1632
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4720
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:1664
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4608
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:2064
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5444
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3808
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5424
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:4180
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:4148
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5440
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:3640
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5216
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5508
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5208
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:768
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4460
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:3504
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:852
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4556
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5804
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:4448
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:3624
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:1104
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5584
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5916
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5912
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:1992
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5272
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:4152
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:3736
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:6076
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5944
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:3748
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:1812
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:2252
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:6132
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:232
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:6064
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4240
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5316
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:4696
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:3196
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:2624
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:2432
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2376
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5364
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5788
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4076
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5476
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:4580
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5496
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:1448
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:4608
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5320
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:752
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:1564
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2828
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5380
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:4180
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:1684
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4148
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5164
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5500
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:3476
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5560
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3520
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:3524
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5264
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:1936
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5864
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:4244
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4752
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:2916
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:3240
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4252
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:1688
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:852
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3304
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:812
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5808
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:1028
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5588
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:540
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5616
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5892
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5124
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3580
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4172
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:6100
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4644
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:6104
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:6124
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2036
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:1984
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:3224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5300
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4604
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:3880
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:2936
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:6088
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:2972
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:1748
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:2948
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:3604
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5348
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4872
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:516
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:468
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:2064
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:2280
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5380
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:3588
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:4732
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4216
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5572
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:3128
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5224
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:3524
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5152
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5188
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5780
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:4328
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5260
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5208
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:2916
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:4188
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5592
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:4252
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2648
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4668
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:2700
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:1856
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5800
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5488
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3720
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:3964
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5820
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5812
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5544
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5128
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4280
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4980
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5924
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3500
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:6068
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:4680
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:3224
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:6132
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:2652
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:3880
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4744
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:6088
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1740
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4696
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:2624
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6128
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:2432
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:2596
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5312
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:1680
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5004
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:1092
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:3544
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5416
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:1756
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:2072
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:1400
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5380
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:3688
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:4932
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:4056
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:3664
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5164
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4372
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:1132
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:2988
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2956
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:512
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:2536
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5572
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:3640
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5508
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2864
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4136
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:1060
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5232
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4812
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5296
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1620
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:768
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:4520
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5592
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5776
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5400
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2340
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5536
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5792
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:3252
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5588
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:3720
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5840
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5896
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5812
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5272
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5888
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:4152
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6104
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5924
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:3500
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2756
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5784
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:6140
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5680
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:396
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5364
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:880
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:2904
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:468
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5612
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4804
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5324
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:4712
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5428
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:5416
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5344
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4528
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:2012
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:3588
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:5380
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:2828
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:4756
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4056
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:436
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3712
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:2696
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:1752
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5500
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:3476
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5572
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5264
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:1936
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      PID:5188
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5816
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:3800
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:2240
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3504
  - - C:\Windows\system32\findstr.exe
      FindStr /B /L /I /C:esif.exe
      4⤵
      PID:4460
  - - C:\Windows\system32\PING.EXE
      ping -n 1 -w 1000 192.168.254.254
      4⤵
      Runs ping.exe
      PID:4268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

system32.exe

Path C:\Program Files (x86)\System32\system32.exe
Size 643KB
SHA256 093c499dff7de550099e66372c9286a26309e637994ecca5dfbf12784cca09c7
MD5 859bf19854edb601af99b5c3d387b8f3
SHA1 b6821d11f67ffe2683225524a174af0e524b2494
SHA512 0af9a2623c991e35a29154fa5c9a506c78da46726bf687c44f032476f24af2904df7ee2758e8fabafbc50ec73fe3f62f55302c23390d59c859eb12b39267b8d6
SSDEEP 12288:yLQmlJyjN2qE/IQNJL9eQ5Wyk0LxxVnaR/Q6lMnYyE4V38ENEltRBjolQqg2OYD4:sENRE/t1TxxVno/L6npEy8ENEltRBjme
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.bat

Path C:\ProgramData\cmd.bat
Size 232B
SHA256 44dfb7f765b1786835a34433d6d5b99bac4f6b1ad3736a8bfbcfa31dd0818b54
MD5 06575ea4afde1fc91eb3737b392bbf57
SHA1 6454bf6e1aa49169a0c67e7239718dcaa2a0440f
SHA512 937232d7844aa356a1f8e652e16304c7850e0fca478ab5bb17aef98e01c32cb11cc455cf280f1e07ea316f5a7ccb3499fd29f7135f809018bc394e27137948c4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 724f4ef68e18040348bd87a9a8e580664873cee53d216a86ffd15b3ab9aa5e45
MD5 ca19db48f9a0745902fdefc8efeedd7c
SHA1 c19788c671f1ebf62fd40e8520d857c2e227efad
SHA512 36cf00e7f90c69ce8577c5790fd35b2740acbb900550220ec7761a7a25cfc54be0c4fdd4aa2fdd1540032dd15a2ca7c510f1b875625710cd1bf4076911b0b353
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 86c9e6844607bf384d5490fd3b62f1f7c83d1e06e5f363bbf0de570ec8304998
MD5 542309b524b4e383f477989c22f39170
SHA1 5a78bac708c0e37064ef298daf639bc92f945e89
SHA512 29c895eb5ca8c9667bc13afbf28d6833fa9ed906d791828535dc22235bcc4cc5342fda47af4dcac1be0685b4f6473ae56de1b2a65c1db4f83c5773c65f533cce
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 3f4446074935eb4615dbb5804412827b893b160bc57bdac3411aab502f81d59e
MD5 dc4d066fac62e761460623aa44a257bf
SHA1 c9b68347ee8b1d48d2812ba71c576698bafcf020
SHA512 f945b1a153f7eb3c2d821f01f3db55b25abd8e895f072cd3e27f134af2e59ed6a0592f247ebbc5eef42f3d46d66015660538bd18c1c3634ce31c9494d8b80d17
SSDEEP 96:nckil1ngjuwpvWMoiVmdeHvSS1dw/UWQyV+VDCziEwb:nckCdgjuGWMXbdw/ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 2443a9e7930f1c82ed74ca233490f4244e0037fa062c1a16319e9c53fb55efd9
MD5 8dfb7bb612aedcc1a1e1273a5ff4c894
SHA1 c833c182634e1d6e394126e5ca8a98945a87ae65
SHA512 f9b48ebba46dba6b942631d74c4afecd16da5e5b630707c59a697c5799f8461e7d840ccf18af54e925e6efe519578f03dbbf3d9792b2d0b31d22a0125c1ea12e
SSDEEP 96:nck5l1nwjuwpvWMoiVmdecPWQYu4WX1DqEVSbDY8GZTp2vSFWQ3zdw/UWQyV+VDp:nckvdwjuGWMPuLkEVSorTp2adw/rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6d73c5bb6c2ab6cb02c4459948cfaf8dd27c62f83672b4b63d9a83839c2b27f6
MD5 1b3df86ece9b92bd3ce6bf780b7ed9c2
SHA1 a6f07ffdc034a31051cc884a4ce4ffbbdcb7848a
SHA512 3bf675d79c9f15f85668fcbe230904f209c0c74c5c7cf62641bbbcfbdf608b027d57a562f7b6a9693dca16cfdfcaecc1aa8fedfcc04333eccc5327430adc2e8a
SSDEEP 192:VoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupqJe2RUfm/4uJ3z2OMDCRHV:Z9iIxuERzA83h09RZxYqdzLJaOMWRHqS
MD5 SHA1 SHA512 SSDEEP

Submit Download