f5ae13049ff90ed8b313c9c217522959ba9b5cd6cc651de196d58decc4aa60bd

Analysis

max time kernel
190s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-09-2024 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Eerie Cleaner V2.bat
Size

4KB
MD5

37ef21adf06934e902670dc77b93f91e
SHA1

e311a65512c8ded721846b07769800f36efe3e62
SHA256

f5ae13049ff90ed8b313c9c217522959ba9b5cd6cc651de196d58decc4aa60bd
SHA512

4b4814a4385c908976cc8f9b47223eeb651cff834024428b58602f34980b8c0c328e84dae2353f7abeb6e88f8575f8a1282726af3683eb2c6c228d4fad3e8775
SSDEEP

48:9dF/xamIWmN9m5lgFLtl+SSISno1hawpMv4R4MCG7nyb4tF5+gwkTp0Ro:9FIWmrClgFLP+SSISnkhaq+tA+QTpz

Score

9^/10

defense_evasion discovery execution impact ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DATAST~1\DATAST~1.EDB	cmd.exe
File opened for modification	C:\Windows\SoftwareDistribution\DATAST~1\DATAST~1.JFM	cmd.exe
File opened for modification	C:\Windows\SoftwareDistribution\DATAST~1\Logs\edb.log	cmd.exe
File opened for modification	C:\Windows\SoftwareDistribution\REPORT~1.LOG	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3648	PING.EXE
1900	PING.EXE
2668	PING.EXE
2512	PING.EXE
3812	PING.EXE
2876	PING.EXE
2100	PING.EXE
4488	PING.EXE
3152	PING.EXE
4368	PING.EXE
3728	PING.EXE
736	PING.EXE
1484	PING.EXE
4844	PING.EXE
4080	PING.EXE
1612	PING.EXE
1388	PING.EXE
3492	PING.EXE
468	PING.EXE
5084	PING.EXE
632	PING.EXE
2440	PING.EXE
2492	PING.EXE
2828	PING.EXE
2664	PING.EXE
216	PING.EXE
216	PING.EXE
4944	PING.EXE
3672	PING.EXE
392	PING.EXE
3628	PING.EXE
1836	PING.EXE
4268	PING.EXE
804	PING.EXE
4876	PING.EXE
3852	PING.EXE
2072	PING.EXE
2096	PING.EXE
4308	PING.EXE
4784	PING.EXE
3968	PING.EXE
3440	PING.EXE
4556	PING.EXE
4072	PING.EXE
3180	PING.EXE
2636	PING.EXE
4048	PING.EXE
4920	PING.EXE
3240	PING.EXE
2140	PING.EXE
4912	PING.EXE
4328	PING.EXE
4968	PING.EXE
1864	PING.EXE
1972	PING.EXE
2396	PING.EXE
2968	PING.EXE
2568	PING.EXE
1392	PING.EXE
3516	PING.EXE
1572	PING.EXE
340	PING.EXE
4572	PING.EXE
4988	PING.EXE

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1084	ipconfig.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3232	vssadmin.exe

Runs net.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
2316	PING.EXE
764	PING.EXE
4232	PING.EXE
1540	PING.EXE
392	PING.EXE
4544	PING.EXE
2072	PING.EXE
4968	PING.EXE
4876	PING.EXE
1576	PING.EXE
2400	PING.EXE
2668	PING.EXE
1484	PING.EXE
4328	PING.EXE
468	PING.EXE
4268	PING.EXE
2852	PING.EXE
468	PING.EXE
2096	PING.EXE
632	PING.EXE
548	PING.EXE
796	PING.EXE
4944	PING.EXE
2872	PING.EXE
3516	PING.EXE
2616	PING.EXE
3820	PING.EXE
4668	PING.EXE
468	PING.EXE
4636	PING.EXE
3240	PING.EXE
2060	PING.EXE
2848	PING.EXE
5068	PING.EXE
2612	PING.EXE
2440	PING.EXE
2492	PING.EXE
1392	PING.EXE
3968	PING.EXE
940	PING.EXE
4632	PING.EXE
1688	PING.EXE
3232	PING.EXE
3008	PING.EXE
4504	PING.EXE
3900	PING.EXE
2828	PING.EXE
2104	PING.EXE
1992	PING.EXE
4848	PING.EXE
4532	PING.EXE
3088	PING.EXE
1084	PING.EXE
2284	PING.EXE
4820	PING.EXE
1016	PING.EXE
2140	PING.EXE
3852	PING.EXE
2288	PING.EXE
2408	PING.EXE
4000	PING.EXE
3812	PING.EXE
1708	PING.EXE
1500	PING.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	3168	vssvc.exe
Token: SeRestorePrivilege	3168	vssvc.exe
Token: SeAuditPrivilege	3168	vssvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 1944	3360	cmd.exe	86
PID 3360 wrote to memory of 1944	3360	cmd.exe	86
PID 3360 wrote to memory of 3668	3360	cmd.exe	87
PID 3360 wrote to memory of 3668	3360	cmd.exe	87
PID 3360 wrote to memory of 2436	3360	cmd.exe	88
PID 3360 wrote to memory of 2436	3360	cmd.exe	88
PID 3360 wrote to memory of 4072	3360	cmd.exe	92
PID 3360 wrote to memory of 4072	3360	cmd.exe	92
PID 3360 wrote to memory of 2100	3360	cmd.exe	93
PID 3360 wrote to memory of 2100	3360	cmd.exe	93
PID 3360 wrote to memory of 3976	3360	cmd.exe	95
PID 3360 wrote to memory of 3976	3360	cmd.exe	95
PID 3360 wrote to memory of 3492	3360	cmd.exe	96
PID 3360 wrote to memory of 3492	3360	cmd.exe	96
PID 3360 wrote to memory of 4368	3360	cmd.exe	97
PID 3360 wrote to memory of 4368	3360	cmd.exe	97
PID 3360 wrote to memory of 468	3360	cmd.exe	98
PID 3360 wrote to memory of 468	3360	cmd.exe	98
PID 3360 wrote to memory of 1504	3360	cmd.exe	99
PID 3360 wrote to memory of 1504	3360	cmd.exe	99
PID 3360 wrote to memory of 2316	3360	cmd.exe	100
PID 3360 wrote to memory of 2316	3360	cmd.exe	100
PID 3360 wrote to memory of 3820	3360	cmd.exe	102
PID 3360 wrote to memory of 3820	3360	cmd.exe	102
PID 3360 wrote to memory of 632	3360	cmd.exe	103
PID 3360 wrote to memory of 632	3360	cmd.exe	103
PID 3360 wrote to memory of 796	3360	cmd.exe	104
PID 3360 wrote to memory of 796	3360	cmd.exe	104
PID 3360 wrote to memory of 2060	3360	cmd.exe	105
PID 3360 wrote to memory of 2060	3360	cmd.exe	105
PID 3360 wrote to memory of 3232	3360	cmd.exe	106
PID 3360 wrote to memory of 3232	3360	cmd.exe	106
PID 3360 wrote to memory of 216	3360	cmd.exe	107
PID 3360 wrote to memory of 216	3360	cmd.exe	107
PID 3360 wrote to memory of 4844	3360	cmd.exe	108
PID 3360 wrote to memory of 4844	3360	cmd.exe	108
PID 3360 wrote to memory of 1472	3360	cmd.exe	109
PID 3360 wrote to memory of 1472	3360	cmd.exe	109
PID 3360 wrote to memory of 2848	3360	cmd.exe	110
PID 3360 wrote to memory of 2848	3360	cmd.exe	110
PID 3360 wrote to memory of 3928	3360	cmd.exe	111
PID 3360 wrote to memory of 3928	3360	cmd.exe	111
PID 3360 wrote to memory of 4080	3360	cmd.exe	112
PID 3360 wrote to memory of 4080	3360	cmd.exe	112
PID 3360 wrote to memory of 1836	3360	cmd.exe	113
PID 3360 wrote to memory of 1836	3360	cmd.exe	113
PID 3360 wrote to memory of 4528	3360	cmd.exe	114
PID 3360 wrote to memory of 4528	3360	cmd.exe	114
PID 3360 wrote to memory of 1284	3360	cmd.exe	115
PID 3360 wrote to memory of 1284	3360	cmd.exe	115
PID 3360 wrote to memory of 1596	3360	cmd.exe	116
PID 3360 wrote to memory of 1596	3360	cmd.exe	116
PID 3360 wrote to memory of 1084	3360	cmd.exe	121
PID 3360 wrote to memory of 1084	3360	cmd.exe	121
PID 3360 wrote to memory of 4544	3360	cmd.exe	123
PID 3360 wrote to memory of 4544	3360	cmd.exe	123
PID 3360 wrote to memory of 3584	3360	cmd.exe	124
PID 3360 wrote to memory of 3584	3360	cmd.exe	124
PID 3360 wrote to memory of 1952	3360	cmd.exe	125
PID 3360 wrote to memory of 1952	3360	cmd.exe	125
PID 3360 wrote to memory of 4968	3360	cmd.exe	126
PID 3360 wrote to memory of 4968	3360	cmd.exe	126
PID 3360 wrote to memory of 1744	3360	cmd.exe	127
PID 3360 wrote to memory of 1744	3360	cmd.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Eerie Cleaner V2.bat"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\system32\mode.com
  mode 80, 28
  2⤵
  PID:1944
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3668
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  PID:2436
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4072
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2100
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:3976
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3492
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:4368
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:468
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:1504
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:2316
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:3820
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:632
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:796
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:2060
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:3232
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:216
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4844
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:1472
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:2848
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:3928
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4080
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:4528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p=". [34mSelect an option: [0m""
  2⤵
  PID:1284
- C:\Windows\system32\choice.exe
  choice /c 123456789AB
  2⤵
  PID:1596
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:1084
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - Runs ping.exe
  PID:4544
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:3584
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:1952
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4968
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:1744
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1572
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4488
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:736
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4920
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:3008
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:3604
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1864
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:2288
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2440
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:2732
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:5068
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:2148
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1972
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4268
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:2872
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p=". [34mSelect an option: [0m""
  2⤵
  PID:3212
- C:\Windows\system32\choice.exe
  choice /c 123456789AB
  2⤵
  PID:1244
- C:\Windows\system32\net.exe
  net stop wuauserv
  2⤵
  PID:4840
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop wuauserv
    3⤵
    PID:216
- C:\Windows\system32\net.exe
  net stop UsoSvc
  2⤵
  PID:2848
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop UsoSvc
    3⤵
    PID:1016
- C:\Windows\system32\gpupdate.exe
  gpupdate /force
  2⤵
  PID:4080
- C:\Windows\system32\net.exe
  net start wuauserv
  2⤵
  PID:4240
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start wuauserv
    3⤵
    PID:3016
- C:\Windows\system32\net.exe
  net start UsoSvc
  2⤵
  PID:1852
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start UsoSvc
    3⤵
    PID:2472
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2396
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2492
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:2016
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3180
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:3088
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:1084
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2968
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1612
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:4504
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:3900
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:4348
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3152
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3648
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4572
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:2852
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:2980
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:3000
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:4556
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:3692
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:804
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:1384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:4476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p=". [34mSelect an option: [0m""
  2⤵
  PID:4300
- C:\Windows\system32\choice.exe
  choice /c 123456789AB
  2⤵
  PID:3020
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  PID:3104
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:1956
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4368
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:468
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:764
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:620
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:1244
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:2284
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:2408
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2096
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:216
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4988
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:1708
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:992
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:3964
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:632
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4308
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:4820
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:4668
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:1016
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:1844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p=". [34mSelect an option: [0m""
  2⤵
  PID:2736
- C:\Windows\system32\choice.exe
  choice /c 123456789AB
  2⤵
  PID:5052
- C:\Windows\system32\Defrag.exe
  defrag C: /U /V
  2⤵
  PID:2516
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4876
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3728
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2140
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2828
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2636
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:4700
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1392
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1900
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:3352
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:4232
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:468
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:1788
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:1576
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:812
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4944
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4912
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4784
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:2104
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4048
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:4636
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:1688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p=". [34mSelect an option: [0m""
  2⤵
  PID:2724
- C:\Windows\system32\choice.exe
  choice /c 123456789AB
  2⤵
  PID:4928
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3232
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3968
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:1992
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:940
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:1540
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:2400
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:3032
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:3836
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:3520
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3240
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2668
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3852
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3440
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:1500
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5084
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:4248
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:3452
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:4000
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:736
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4556
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3672
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:4848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:1140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p=". [34mSelect an option: [0m""
  2⤵
  PID:4416
- C:\Windows\system32\choice.exe
  choice /c 123456789AB
  2⤵
  PID:5040
- C:\Windows\system32\PING.EXE
  ping localhost -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1484
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:3684
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:548
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4328
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:1996
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:392
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:4444
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2512
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3628
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3516
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2072
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:4632
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:2616
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3812
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2876
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:3316
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:4532
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  PID:4112
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2664
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1388
- C:\Windows\system32\PING.EXE
  ping localhost -n 1
  2⤵
  - Runs ping.exe
  PID:2612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:4224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p=". [34mSelect an option: [0m""
  2⤵
  PID:1488
- C:\Windows\system32\choice.exe
  choice /c 123456789AB
  2⤵
  PID:340