0cad6aa35e8bc5c0148fd17b3ebb3477175520cd6bf32fcde9ab19ca03425a29

Analysis

max time kernel
1798s
max time network
1395s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2023, 03:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AnDDoS.exe
Size 522KB
Sample230714-dk6m1sca23
SHA256 0cad6aa35e8bc5c0148fd17b3ebb3477175520cd6bf32fcde9ab19ca03425a29
MD5 d027869ca68b6df09e2fe721a1acb994
SHA1 d50ea5e2ab1b5b9362f010248328b19a5a395dfe
SHA512 8890d7ac227a7a8368a71a84797916521886d58de69c78ecccea82ec357f33930b28ac215905ee926b2d9f93808ff72d37cd600511eab1c4e16b9140891601a5
SSDEEP 12288:cCga6BJor4hQMdhwS9XVCga6BJor4hQMdhwS9Xm:cCga6BJe4q6JlCga6BJe4q6J2
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
5732	PING.EXE
8828	PING.EXE
9236	PING.EXE
2304	PING.EXE
2236	PING.EXE
9332	PING.EXE
404	PING.EXE
5264	PING.EXE
7860	PING.EXE
9260	PING.EXE
2148	PING.EXE
3764	PING.EXE
7012	PING.EXE
10248	PING.EXE
1140	PING.EXE
1772	PING.EXE
5460	PING.EXE
1792	PING.EXE
8512	PING.EXE
9604	PING.EXE
2520	PING.EXE
4860	PING.EXE
3252	PING.EXE
6476	PING.EXE
6900	PING.EXE
7536	PING.EXE
6632	PING.EXE
4652	PING.EXE
5476	PING.EXE
5660	PING.EXE
5548	PING.EXE
4524	PING.EXE
1068	PING.EXE
3520	PING.EXE
1992	PING.EXE
4340	PING.EXE
7788	PING.EXE
7020	PING.EXE
8304	PING.EXE
3484	PING.EXE
10808	PING.EXE
5552	PING.EXE
8964	PING.EXE
1596	PING.EXE
8260	PING.EXE
8816	PING.EXE
1644	PING.EXE
5028	PING.EXE
5436	PING.EXE
11128	PING.EXE
4408	PING.EXE
3048	PING.EXE
5360	PING.EXE
1548	PING.EXE
5532	PING.EXE
6232	PING.EXE
8096	PING.EXE
2772	PING.EXE
2744	PING.EXE
9196	PING.EXE
6624	PING.EXE
6776	PING.EXE
4788	PING.EXE
2872	PING.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 2984	4976	AnDDoS.exe	98
PID 4976 wrote to memory of 2984	4976	AnDDoS.exe	98
PID 4976 wrote to memory of 2984	4976	AnDDoS.exe	98
PID 2984 wrote to memory of 404	2984	cmd.exe	100
PID 2984 wrote to memory of 404	2984	cmd.exe	100
PID 2984 wrote to memory of 404	2984	cmd.exe	100
PID 4976 wrote to memory of 3816	4976	AnDDoS.exe	101
PID 4976 wrote to memory of 3816	4976	AnDDoS.exe	101
PID 4976 wrote to memory of 3816	4976	AnDDoS.exe	101
PID 3816 wrote to memory of 3484	3816	cmd.exe	103
PID 3816 wrote to memory of 3484	3816	cmd.exe	103
PID 3816 wrote to memory of 3484	3816	cmd.exe	103
PID 4976 wrote to memory of 952	4976	AnDDoS.exe	104
PID 4976 wrote to memory of 952	4976	AnDDoS.exe	104
PID 4976 wrote to memory of 952	4976	AnDDoS.exe	104
PID 952 wrote to memory of 1596	952	cmd.exe	106
PID 952 wrote to memory of 1596	952	cmd.exe	106
PID 952 wrote to memory of 1596	952	cmd.exe	106
PID 4976 wrote to memory of 4000	4976	AnDDoS.exe	107
PID 4976 wrote to memory of 4000	4976	AnDDoS.exe	107
PID 4976 wrote to memory of 4000	4976	AnDDoS.exe	107
PID 4000 wrote to memory of 752	4000	cmd.exe	109
PID 4000 wrote to memory of 752	4000	cmd.exe	109
PID 4000 wrote to memory of 752	4000	cmd.exe	109
PID 4976 wrote to memory of 4916	4976	AnDDoS.exe	123
PID 4976 wrote to memory of 4916	4976	AnDDoS.exe	123
PID 4976 wrote to memory of 4916	4976	AnDDoS.exe	123
PID 4916 wrote to memory of 1668	4916	cmd.exe	125
PID 4916 wrote to memory of 1668	4916	cmd.exe	125
PID 4916 wrote to memory of 1668	4916	cmd.exe	125
PID 4976 wrote to memory of 4412	4976	AnDDoS.exe	126
PID 4976 wrote to memory of 4412	4976	AnDDoS.exe	126
PID 4976 wrote to memory of 4412	4976	AnDDoS.exe	126
PID 4412 wrote to memory of 3356	4412	cmd.exe	128
PID 4412 wrote to memory of 3356	4412	cmd.exe	128
PID 4412 wrote to memory of 3356	4412	cmd.exe	128
PID 4976 wrote to memory of 2296	4976	AnDDoS.exe	129
PID 4976 wrote to memory of 2296	4976	AnDDoS.exe	129
PID 4976 wrote to memory of 2296	4976	AnDDoS.exe	129
PID 2296 wrote to memory of 2736	2296	cmd.exe	131
PID 2296 wrote to memory of 2736	2296	cmd.exe	131
PID 2296 wrote to memory of 2736	2296	cmd.exe	131
PID 4976 wrote to memory of 4552	4976	AnDDoS.exe	132
PID 4976 wrote to memory of 4552	4976	AnDDoS.exe	132
PID 4976 wrote to memory of 4552	4976	AnDDoS.exe	132
PID 4552 wrote to memory of 788	4552	cmd.exe	134
PID 4552 wrote to memory of 788	4552	cmd.exe	134
PID 4552 wrote to memory of 788	4552	cmd.exe	134
PID 4976 wrote to memory of 1348	4976	AnDDoS.exe	136
PID 4976 wrote to memory of 1348	4976	AnDDoS.exe	136
PID 4976 wrote to memory of 1348	4976	AnDDoS.exe	136
PID 1348 wrote to memory of 1816	1348	cmd.exe	138
PID 1348 wrote to memory of 1816	1348	cmd.exe	138
PID 1348 wrote to memory of 1816	1348	cmd.exe	138
PID 4976 wrote to memory of 2820	4976	AnDDoS.exe	139
PID 4976 wrote to memory of 2820	4976	AnDDoS.exe	139
PID 4976 wrote to memory of 2820	4976	AnDDoS.exe	139
PID 2820 wrote to memory of 4956	2820	cmd.exe	141
PID 2820 wrote to memory of 4956	2820	cmd.exe	141
PID 2820 wrote to memory of 4956	2820	cmd.exe	141
PID 4976 wrote to memory of 1076	4976	AnDDoS.exe	142
PID 4976 wrote to memory of 1076	4976	AnDDoS.exe	142
PID 4976 wrote to memory of 1076	4976	AnDDoS.exe	142
PID 1076 wrote to memory of 4652	1076	cmd.exe	144

C:\Users\Admin\AppData\Local\Temp\AnDDoS.exe
"C:\Users\Admin\AppData\Local\Temp\AnDDoS.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:3484
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:1596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:752
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:1668
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:3356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:2736
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:1816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:4956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:4652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:1960
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:1068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:3320
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:2520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:1080
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:4276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:2288
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:5028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:2864
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:3464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:4092
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:1140
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:3364
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:3124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:4948
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:4364
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:408
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:880
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:4860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:3580
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:2148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:2452
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:4452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:396
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:1208
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:4032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:1372
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:3424
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:668
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:2304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:644
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:4804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:1388
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:2744
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:2388
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:3252
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:5052
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:2284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:3928
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:3392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:4168
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:3764
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:4608
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:3520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:100
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:1912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:2788
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:4612
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:3988
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:1724
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:3968
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:2732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:1248
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:2596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:2156
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:4188
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:4940
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:3036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:3496
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:1992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:1800
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:3048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:2580
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:4812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:3472
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:1772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:4832
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:8
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:2184
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:3632
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:4932
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:4580
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:2316
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:4524
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:3360
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:4876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:636
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:5140
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:5188
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:5256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:5288
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:5360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:5400
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:5476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:5500
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:5568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:5592
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:5660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:5700
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:5772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:5912
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:5984
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:6028
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:6096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:6132
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:3668
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:4628
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:4408
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:2752
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:5516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:5604
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:5720
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:1648
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:1548
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:3516
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:5532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:2696
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:4892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:2112
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:5460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:5796
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:5876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:5464
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:5132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:4316
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:5744
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:4808
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:5732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:5608
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:5436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:5668
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:5080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:6124
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:4140
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:3120
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:5548
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:6152
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:6232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:6264
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:6336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:6400
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:6476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:6540
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:6616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:6692
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:6776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:6824
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:6900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:6936
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:7012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:7092
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:6168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:5424
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:4104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:5860
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:6244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:2528
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:6840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:3636
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:6624
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:6756
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:6328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:3300
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:3020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:6708
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:4340
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:6084
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:7008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:4768
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:7156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:6504
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:4444
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:7152
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:2612
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:5208
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:1792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:7460
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:7536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:7572
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:7656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:7712
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:7788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:7884
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:7964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:8020
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:8096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:8160
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:6948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:5420
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:2772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:6572
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:4356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:6768
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:7800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:7492
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:7604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:6892
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:6592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:7768
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:6516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:6196
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:7020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:680
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:7764
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:7104
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:7532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:8228
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:8304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:8356
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:8432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:8476
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:8556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:8616
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:8700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:8756
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:8828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:8880
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:8956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:7920
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:8260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:3732
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:4788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:4472
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:2872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:8628
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:9236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:9312
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:9388
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:9468
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:9548
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:9632
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:9712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:9752
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:9828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:9872
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:9948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:10016
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:10096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:10156
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:10232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:9276
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:8788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:8292
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:8808
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:9120
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:5264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:6928
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:7948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:8300
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:7860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:8948
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:8816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:9724
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:10172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:7028
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:9384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:9444
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:8512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:9700
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:5812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:10128
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:9332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:10044
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:8964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:9044
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:9300
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:8820
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:9156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:9732
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:6880
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:8012
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:6908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:7760
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:5552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:8060
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:1644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:1368
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:6632
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:1376
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:9196
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:9128
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:9260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:5456
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:9088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:8040
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:9944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:5780
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:9604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:8004
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:8592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:7676
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:10248
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:10328
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:10388
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:10460
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:10524
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:10604
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:10672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:10744
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:10808
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:11068
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    - Runs ping.exe
    PID:11128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:11252
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:9500
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:8992
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:10480
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:8848
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:3232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:8240
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:6680
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 109.230.57.244 -t
  2⤵
  PID:11088
- - C:\Windows\SysWOW64\PING.EXE
    ping 109.230.57.244 -t
    3⤵
    PID:8600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4976-133-0x0000000000B50000-0x0000000000BDA000-memory.dmp

Download

memory/4976-134-0x0000000074F40000-0x00000000756F0000-memory.dmp

Download

memory/4976-135-0x0000000005570000-0x000000000560C000-memory.dmp

Download

memory/4976-136-0x0000000005C30000-0x00000000061D4000-memory.dmp

Download

memory/4976-137-0x0000000005720000-0x00000000057B2000-memory.dmp

Download

memory/4976-138-0x0000000005990000-0x00000000059A0000-memory.dmp

Download

memory/4976-139-0x0000000005680000-0x000000000568A000-memory.dmp

Download

memory/4976-140-0x00000000058B0000-0x0000000005906000-memory.dmp

Download

memory/4976-141-0x0000000005990000-0x00000000059A0000-memory.dmp

Download

memory/4976-142-0x0000000074F40000-0x00000000756F0000-memory.dmp

Download

memory/4976-143-0x0000000005990000-0x00000000059A0000-memory.dmp

Download

memory/4976-144-0x0000000005990000-0x00000000059A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads