b886f0f57d9e944eb4b10c4d450a35de8c8c9600165763be791965018811d453

Analysis

user interaction
yes
max time kernel
5s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
random.exe
Size 68.4MB
Sample260420-wtbs4sdv3s
SHA256 b886f0f57d9e944eb4b10c4d450a35de8c8c9600165763be791965018811d453
MD5 32ef7ce014256c36fe3fe0cd53d9ffe5
SHA1 df7cc825e3d173342fb2f0d00ac2ed3baae891ef
SHA512 b995680d29b1008aeee232b04c6000521ca087e212c7978e0aa8311a34d5b8bc7ed3ea9ccf945a179276d5ef4bdb188a5012a9237bfd65105171bd190315fd72
SSDEEP 1572864:PDvKxhT1FgcW/JCkT0WhosMZT0wYFtRmECOfWZctdu:PDSxhpucA1T7oeY9IWwdu
TLSH
T1ECF72356E2FD00E8D9BAC0B8C6571617E7B13449173097EF56A48A692F37BE0AE3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2808	powershell.exe
2368	powershell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1016	Process not Found
3936	PING.EXE
784	PING.EXE
5996	PING.EXE
6084	PING.EXE
5144	PING.EXE
1148	PING.EXE
2012	PING.EXE
5500	PING.EXE
880	PING.EXE
4932	PING.EXE
5036	PING.EXE
4964	Process not Found
4672	PING.EXE
5456	PING.EXE
232	PING.EXE
5184	PING.EXE
3356	PING.EXE
4568	PING.EXE
2584	PING.EXE
4008	PING.EXE
484	PING.EXE
5212	PING.EXE
5192	PING.EXE
4640	PING.EXE
5264	PING.EXE
1760	PING.EXE
3416	PING.EXE
3636	PING.EXE
1740	Process not Found
796	PING.EXE
1676	PING.EXE
3348	PING.EXE
948	PING.EXE
3100	PING.EXE
4892	PING.EXE
4904	PING.EXE
4612	Process not Found
4840	PING.EXE
2696	PING.EXE
3172	PING.EXE
4744	PING.EXE
3692	PING.EXE
2168	PING.EXE
4152	Process not Found
5892	Process not Found
5828	PING.EXE
4432	Process not Found
3376	Process not Found
1400	PING.EXE
2932	PING.EXE
2168	PING.EXE
5536	PING.EXE
5372	Process not Found
3624	PING.EXE
1860	PING.EXE
3356	PING.EXE
1508	PING.EXE
1760	Process not Found
6076	PING.EXE
3872	PING.EXE
5192	Process not Found
4396	Process not Found
4100	PING.EXE

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
4568	PING.EXE
6076	PING.EXE
4664	PING.EXE
784	PING.EXE
424	PING.EXE
1016	Process not Found
4716	PING.EXE
848	PING.EXE
3428	PING.EXE
2996	PING.EXE
1384	PING.EXE
568	PING.EXE
4156	Process not Found
4772	Process not Found
752	Process not Found
1820	PING.EXE
3120	PING.EXE
3480	PING.EXE
5876	PING.EXE
1956	PING.EXE
5996	Process not Found
4892	Process not Found
3508	PING.EXE
1016	PING.EXE
3580	PING.EXE
4480	PING.EXE
3960	Process not Found
3772	Process not Found
2868	PING.EXE
4480	PING.EXE
4628	PING.EXE
2104	PING.EXE
5164	PING.EXE
5296	PING.EXE
5088	PING.EXE
2084	PING.EXE
5384	PING.EXE
5300	PING.EXE
3256	PING.EXE
3496	PING.EXE
4604	PING.EXE
1744	PING.EXE
5360	PING.EXE
5996	PING.EXE
2512	PING.EXE
824	Process not Found
6080	Process not Found
6008	PING.EXE
6096	PING.EXE
1868	PING.EXE
3276	PING.EXE
1548	PING.EXE
3384	PING.EXE
3220	PING.EXE
5132	Process not Found
4356	PING.EXE
4956	PING.EXE
5920	PING.EXE
2868	PING.EXE
3032	Process not Found
5476	PING.EXE
5272	PING.EXE
1780	PING.EXE
3204	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2808	powershell.exe
2808	powershell.exe
2368	powershell.exe
2368	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 2808	5012	random.exe	79
PID 2808 wrote to memory of 4876	2808	powershell.exe	81
PID 2808 wrote to memory of 5624	2808	powershell.exe	83
PID 2808 wrote to memory of 1136	2808	powershell.exe	85
PID 2808 wrote to memory of 1976	2808	powershell.exe	87
PID 2808 wrote to memory of 3020	2808	powershell.exe	89
PID 2808 wrote to memory of 704	2808	powershell.exe	91
PID 2808 wrote to memory of 5776	2808	powershell.exe	93
PID 1136 wrote to memory of 4772	1136	cmd.exe	95
PID 2808 wrote to memory of 5376	2808	powershell.exe	96
PID 2808 wrote to memory of 2368	2808	powershell.exe	98
PID 4876 wrote to memory of 4360	4876	cmd.exe	100
PID 5624 wrote to memory of 1760	5624	cmd.exe	101
PID 1136 wrote to memory of 5928	1136	cmd.exe	197
PID 704 wrote to memory of 6076	704	cmd.exe	387
PID 5376 wrote to memory of 3348	5376	cmd.exe	104
PID 5776 wrote to memory of 3204	5776	cmd.exe	486
PID 3020 wrote to memory of 1604	3020	cmd.exe	106
PID 1976 wrote to memory of 5476	1976	cmd.exe	579
PID 4876 wrote to memory of 1508	4876	cmd.exe	108
PID 4876 wrote to memory of 4760	4876	cmd.exe	109
PID 5624 wrote to memory of 5308	5624	cmd.exe	395
PID 704 wrote to memory of 3936	704	cmd.exe	585
PID 5376 wrote to memory of 1972	5376	cmd.exe	112
PID 1136 wrote to memory of 420	1136	cmd.exe	113
PID 5776 wrote to memory of 2100	5776	cmd.exe	398
PID 1976 wrote to memory of 568	1976	cmd.exe	586
PID 3020 wrote to memory of 2064	3020	cmd.exe	116
PID 1976 wrote to memory of 5812	1976	cmd.exe	591
PID 1976 wrote to memory of 3624	1976	cmd.exe	686
PID 4876 wrote to memory of 3872	4876	cmd.exe	119
PID 5624 wrote to memory of 3880	5624	cmd.exe	120
PID 1976 wrote to memory of 5368	1976	cmd.exe	309
PID 704 wrote to memory of 5656	704	cmd.exe	693
PID 5376 wrote to memory of 3892	5376	cmd.exe	123
PID 1136 wrote to memory of 6108	1136	cmd.exe	779
PID 5776 wrote to memory of 5256	5776	cmd.exe	598
PID 3020 wrote to memory of 5556	3020	cmd.exe	695
PID 1976 wrote to memory of 1152	1976	cmd.exe	506
PID 3020 wrote to memory of 1672	3020	cmd.exe	128
PID 1136 wrote to memory of 2748	1136	cmd.exe	129
PID 3020 wrote to memory of 3172	3020	cmd.exe	885
PID 1136 wrote to memory of 2432	1136	cmd.exe	788
PID 4876 wrote to memory of 5980	4876	cmd.exe	606
PID 5624 wrote to memory of 3792	5624	cmd.exe	889
PID 704 wrote to memory of 1780	704	cmd.exe	607
PID 5376 wrote to memory of 1864	5376	cmd.exe	605
PID 5776 wrote to memory of 5448	5776	cmd.exe	416
PID 5376 wrote to memory of 2936	5376	cmd.exe	801
PID 1976 wrote to memory of 232	1976	cmd.exe	803
PID 5776 wrote to memory of 244	5776	cmd.exe	898
PID 1976 wrote to memory of 4436	1976	cmd.exe	990
PID 3020 wrote to memory of 5428	3020	cmd.exe	710
PID 4876 wrote to memory of 5380	4876	cmd.exe	1000
PID 1136 wrote to memory of 4612	1136	cmd.exe	615
PID 5624 wrote to memory of 2104	5624	cmd.exe	902
PID 704 wrote to memory of 1124	704	cmd.exe	1095
PID 5376 wrote to memory of 4500	5376	cmd.exe	146
PID 5776 wrote to memory of 4556	5776	cmd.exe	147
PID 1976 wrote to memory of 3940	1976	cmd.exe	1099
PID 5776 wrote to memory of 3064	5776	cmd.exe	1007
PID 1136 wrote to memory of 5828	1136	cmd.exe	430
PID 4876 wrote to memory of 3400	4876	cmd.exe	903
PID 704 wrote to memory of 6136	704	cmd.exe	1011

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\PrankSim_3cf414fdbe324a6a8597da8ccdba4e2d\RunPrankCore.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /k title FAKEVIR_1& color 0A & for /L %z in (0,0,1) do (echo [W32.Dropper.1] segment=%RANDOM% heuristic=GEN:FAKE & echo [TROJAN] packed payload -- NOT REAL -- & echo [ADWARE] cookie_stealer_sim.dll & ping -n 1 127.0.0.1 > nul)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4360
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1508
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4760
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3872
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5980
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5380
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3400
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2804
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5288
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1820
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5852
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1800
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2280
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5272
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3652
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5008
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1432
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4788
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2116
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4780
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4152
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2920
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5200
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5368
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3172
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5152
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3064
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3240
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3444
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4912
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1252
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5296
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5656
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3496
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2696
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5828
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3920
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2804
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4744
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3080
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1660
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5868
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3744
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2420
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3388
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3760
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1152
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2936
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3580
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4844
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5148
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5344
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4968
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1452
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4532
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5508
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4660
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5656
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1780
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4348
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1456
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4344
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2116
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2012
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3100
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1572
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1508
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5936
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5556
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2696
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:968
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2600
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:932
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2752
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5192
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:784
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6032
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4316
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4592
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4324
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5088
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5848
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1720
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3256
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1744
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5192
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4672
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3228
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6032
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3960
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5496
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5296
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3692
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4480
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5396
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5152
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3400
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3128
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4936
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3552
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6120
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5036
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3516
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4076
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2232
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5832
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3792
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4892
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5184
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4788
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4440
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1956
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2108
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4008
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2868
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4592
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:568
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3840
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2432
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3900
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:232
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5152
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1548
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:484
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3128
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /k title FAKEVIR_2& color 0A & for /L %z in (0,0,1) do (echo [W32.Dropper.2] segment=%RANDOM% heuristic=GEN:FAKE & echo [TROJAN] packed payload -- NOT REAL -- & echo [ADWARE] cookie_stealer_sim.dll & ping -n 1 127.0.0.1 > nul)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5624
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1760
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5308
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3880
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3792
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2104
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5264
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2356
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4672
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4964
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3284
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1044
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4660
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5812
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:648
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5612
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4536
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3580
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5828
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4344
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4840
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1868
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4356
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3204
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5180
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4400
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2084
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5544
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5692
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3940
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1968
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5492
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5028
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3744
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1840
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:6076
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1576
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5632
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3544
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:412
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5516
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4640
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3676
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2632
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5264
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4716
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4840
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1644
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4956
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1412
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5296
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5088
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1144
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4612
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5380
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5844
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5268
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4516
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4256
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5056
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3236
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1116
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3936
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4764
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2636
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:968
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3828
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:576
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4052
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3920
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2108
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4884
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5260
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4076
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1576
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2100
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2456
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5300
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3096
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1744
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4344
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3240
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4564
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5344
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2336
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1572
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1116
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2236
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5352
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1388
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5212
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5360
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6080
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5528
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5440
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1812
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3448
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1048
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1284
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3092
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5996
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:948
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5220
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2168
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3360
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2804
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4884
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5892
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4772
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1412
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1312
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3220
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3760
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1960
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2508
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4560
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:536
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4312
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2908
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:6084
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5732
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5180
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6108
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5548
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4904
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5540
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5536
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3676
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4416
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /k title FAKEVIR_3& color 0A & for /L %z in (0,0,1) do (echo [W32.Dropper.3] segment=%RANDOM% heuristic=GEN:FAKE & echo [TROJAN] packed payload -- NOT REAL -- & echo [ADWARE] cookie_stealer_sim.dll & ping -n 1 127.0.0.1 > nul)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1136
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4772
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5928
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:420
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6108
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2748
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2432
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4612
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5828
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6140
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:432
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3552
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5228
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2688
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2920
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1148
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3692
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2092
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3708
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3160
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1456
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1500
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3804
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6104
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4888
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6032
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3508
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5332
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1964
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3980
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4800
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5380
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1744
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2804
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5192
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4948
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1644
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2276
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2420
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2100
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3220
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5300
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1816
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3180
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5148
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4460
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5072
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5028
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5144
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3204
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2280
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2272
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5656
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5912
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:848
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3076
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5288
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2428
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5320
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4432
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5500
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5812
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:824
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5980
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5692
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:904
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4688
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1804
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3120
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:952
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5824
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2204
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4756
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1740
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:900
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4740
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5400
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3400
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2168
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4624
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4448
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4932
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1832
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1676
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4908
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5200
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5940
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1588
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4536
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1500
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5504
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4708
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3632
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6120
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5868
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2556
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5508
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2584
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3772
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1960
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2600
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2532
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4416
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4960
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5580
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4300
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1424
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1384
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3276
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3820
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5656
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5444
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5516
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5380
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:576
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3076
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6120
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5132
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5988
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4796
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4360
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3936
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2584
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3980
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1628
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3568
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3416
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1480
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4344
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /k title FAKEVIR_4& color 0A & for /L %z in (0,0,1) do (echo [W32.Dropper.4] segment=%RANDOM% heuristic=GEN:FAKE & echo [TROJAN] packed payload -- NOT REAL -- & echo [ADWARE] cookie_stealer_sim.dll & ping -n 1 127.0.0.1 > nul)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5476
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:568
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5812
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3624
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5368
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1152
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:232
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4436
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3940
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4504
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1804
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:784
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1868
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1836
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4316
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1888
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5552
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5300
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5516
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1480
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5876
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4428
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:784
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5260
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6056
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2868
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5732
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1044
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3840
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:948
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2248
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3380
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2512
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4256
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1868
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5260
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1952
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5576
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5384
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4880
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5480
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3388
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3568
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5540
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:576
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:536
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6092
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2828
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4964
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5832
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2180
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2276
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4916
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3340
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3416
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2780
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3064
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3804
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4108
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4944
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1836
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4772
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3376
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5476
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4664
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5196
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2476
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2052
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4196
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3660
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4672
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3444
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4616
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1492
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3204
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2840
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3496
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4628
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5428
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3420
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3660
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2828
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3124
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1952
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2232
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1740
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6108
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2636
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2936
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4196
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5364
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5036
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2112
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4964
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3348
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3908
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4036
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4628
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5300
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6080
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5216
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4888
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5072
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5408
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2376
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2236
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4012
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5272
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3416
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5360
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5388
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4256
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5036
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5176
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3508
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1148
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5236
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5556
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5300
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5528
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5136
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4568
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /k title FAKEVIR_5& color 0A & for /L %z in (0,0,1) do (echo [W32.Dropper.5] segment=%RANDOM% heuristic=GEN:FAKE & echo [TROJAN] packed payload -- NOT REAL -- & echo [ADWARE] cookie_stealer_sim.dll & ping -n 1 127.0.0.1 > nul)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1604
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2064
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5556
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1672
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3172
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5428
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1920
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5192
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5092
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6056
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5456
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3508
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3376
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:6008
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4036
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:332
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3380
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5528
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5600
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2356
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4100
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1644
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4908
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1412
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2240
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2212
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5088
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5896
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5232
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3420
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3956
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2736
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5136
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4308
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5344
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2820
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1928
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5308
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:424
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4764
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4584
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1780
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5232
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3028
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1968
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6120
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3120
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1952
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4604
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1572
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1888
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3276
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1552
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3792
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2084
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:228
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2508
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5860
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3656
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4100
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3124
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1596
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1860
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1516
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3032
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4480
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2720
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:828
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:880
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4504
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6088
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4928
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6032
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2868
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1384
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3388
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1856
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:796
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5152
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:576
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1260
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2888
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5004
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3236
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2652
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3588
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5836
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5524
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5380
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2500
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:484
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1496
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3444
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1676
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2688
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5680
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5500
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3820
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:124
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3356
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5860
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5380
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3656
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5704
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4404
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5968
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4760
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2336
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4956
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1688
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1044
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5788
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3772
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:228
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4456
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6080
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4716
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5092
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3536
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5408
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1508
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5552
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:684
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4612
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1720
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5264
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /k title FAKEVIR_6& color 0A & for /L %z in (0,0,1) do (echo [W32.Dropper.6] segment=%RANDOM% heuristic=GEN:FAKE & echo [TROJAN] packed payload -- NOT REAL -- & echo [ADWARE] cookie_stealer_sim.dll & ping -n 1 127.0.0.1 > nul)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:704
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6076
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3936
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5656
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1780
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1124
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6136
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4732
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2996
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5492
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5048
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5040
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3428
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5928
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4452
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2236
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3908
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5788
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2440
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:244
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6136
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3076
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4240
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4648
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4316
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2088
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2784
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5164
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4584
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5212
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5860
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6072
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1500
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1656
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2012
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:656
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4772
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2236
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3980
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5272
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5448
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5360
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1124
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1260
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5364
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5472
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2688
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3352
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4920
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1856
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3980
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4584
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4536
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1816
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2228
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3128
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2736
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6088
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5704
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4404
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5968
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5920
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5332
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3384
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1856
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5256
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1864
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4612
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1816
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1548
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2136
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4404
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6064
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5892
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3508
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3352
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2220
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4764
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4480
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4640
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4252
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2496
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4888
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5048
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3428
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:564
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3964
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3864
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1516
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3276
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3892
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3708
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5692
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3360
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5492
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4428
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5056
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1820
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2820
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3896
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:424
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3220
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3792
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:244
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4228
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2512
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3888
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4448
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1812
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3100
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2412
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5552
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3172
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4436
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6072
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3532
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2632
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5604
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4648
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6064
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3960
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1476
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5620
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1688
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1960
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5980
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3380
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3256
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /k title FAKEVIR_7& color 0A & for /L %z in (0,0,1) do (echo [W32.Dropper.7] segment=%RANDOM% heuristic=GEN:FAKE & echo [TROJAN] packed payload -- NOT REAL -- & echo [ADWARE] cookie_stealer_sim.dll & ping -n 1 127.0.0.1 > nul)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5776
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3204
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2100
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5256
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5448
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:244
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4556
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3064
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5712
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1656
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4968
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1660
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1116
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2692
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2636
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2248
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5544
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1408
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5136
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1400
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3552
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5968
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2412
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:6076
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4660
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3772
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2244
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4904
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:6096
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1456
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5216
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4564
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3120
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3080
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5032
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1820
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2768
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1688
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1856
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5940
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3792
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5400
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1016
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:852
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6136
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6088
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4652
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2800
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3100
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1800
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4756
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3092
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3568
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3900
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2532
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4304
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2144
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3548
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5044
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:656
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4908
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:568
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4520
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4400
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4800
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5360
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3064
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5712
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5608
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3636
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3296
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1676
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1892
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5384
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3348
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3384
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3980
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3760
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2440
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5396
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3828
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3128
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5604
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4364
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5132
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4880
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4432
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5476
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3032
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5368
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1552
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:232
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3064
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2116
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5072
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4300
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3744
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3008
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1932
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3352
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4012
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:480
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2840
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3172
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2076
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2104
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3676
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3580
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2736
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4744
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2112
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1660
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2868
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1888
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5840
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1740
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1552
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2600
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3356
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3808
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2356
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3656
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3308
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5016
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3448
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1252
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2784
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3032
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:900
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4232
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:948
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5544
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3828
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3940
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1408
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /k title FAKEVIR_8& color 0A & for /L %z in (0,0,1) do (echo [W32.Dropper.8] segment=%RANDOM% heuristic=GEN:FAKE & echo [TROJAN] packed payload -- NOT REAL -- & echo [ADWARE] cookie_stealer_sim.dll & ping -n 1 127.0.0.1 > nul)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5376
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3348
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1972
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3892
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1864
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2936
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4500
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1500
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4308
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4568
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1956
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4352
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5532
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1928
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1688
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3220
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3588
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1388
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5304
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:232
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:848
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5264
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5608
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2012
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5032
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1892
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1476
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5296
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3224
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5256
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1552
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5848
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2052
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3256
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3128
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2888
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4460
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4964
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3136
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3204
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5088
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1552
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4704
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5544
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2496
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2848
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5032
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5852
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2768
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3032
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5556
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5300
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3480
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6140
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4652
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6032
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5512
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1384
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1664
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2932
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:796
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2600
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5152
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5844
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6136
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3076
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5148
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5028
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5320
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1860
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3624
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5656
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4584
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5692
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3532
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3360
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2804
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5672
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5016
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5868
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5920
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4900
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1312
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2064
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2432
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5300
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:412
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4736
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5400
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2996
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6136
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2892
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1956
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3296
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4356
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3376
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4920
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3544
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2084
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5948
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5184
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1656
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4788
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4912
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3744
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2064
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3872
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4232
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1780
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4640
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3064
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:6136
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5876
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5216
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4948
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1660
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:5412
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4452
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2420
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2240
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:4740
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:3160
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:1124
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      PID:2168
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\PrankSim_3cf414fdbe324a6a8597da8ccdba4e2d\ScaryConsole.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 37d6284237c6b7c26ab4720af762286159940d281472d7898f53500243a33d98
MD5 c3e764a84a4410c890cb2fb90c78ac12
SHA1 c93b38a9dacd25b5f2a90177e1b05d1bc6897021
SHA512 dbefe37939f0745c5e21706d702a147f74c45f9fee3e774a3d6ec46e78913cd61e474efc9ee8de8a9d4789f93f35564dcd192515b71ab04f2e5a2126c27d433a
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3hibjoRjdvRBMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5h
TLSH
T1B1538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RansomJoke.ps1

Path C:\Users\Admin\AppData\Local\Temp\PrankSim_3cf414fdbe324a6a8597da8ccdba4e2d\RansomJoke.ps1
Size 13KB
SHA256 d5e50e83f5a46457f7fc1f8f51cd70be4019d85b8cfba488256e93e3ae50ee1e
MD5 e93c33f8561be2614babb8733ad5ba38
SHA1 3741a150a87b9be965630485f6f42aad35ceaf0f
SHA512 d78ee130d4675b2340e7412ccd1212770f64eb735769042e7d99cb8c4e74b4665807ec899e4033029447d6b8fd098ad12cc5179981aba3492206e6302f01b76f
SSDEEP 384:kgeXRwVJBkzMek0ok8cmWy8jkJ3uQcL9yjJ0B5TuHGovFg4wm/QN/NyEUOgO9OQe:1BN8otQNPUBO9OQkD
TLSH
T16B52933A2F1EC5260BB2560AC95FD9C5DE6A22372119DC2938FFD345FB55048A338A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RunPrankCore.ps1

Path C:\Users\Admin\AppData\Local\Temp\PrankSim_3cf414fdbe324a6a8597da8ccdba4e2d\RunPrankCore.ps1
Size 879B
SHA256 637e242d9cc4c834f9aa4a42ba85d2502c685d8e72cd1b6f44dd2ce29a4447a4
MD5 88bbd33bb9897f5b8fea04ba8afc2f46
SHA1 50d61608cb9cc4f47cc6f3602fcf094e005687df
SHA512 1ac2dfbc0e53d220a41b5d9c7ae12100b606150301ab137b5bd7e2e0986f957c6a8947cd619122eb22f90c66d7ad1bb5d8dff9698d8d7eef44abe04fd0fccdde
TLSH
T1B2116339BA2DE26480FCD82170FB8A337B3E903D80373D0179200A6C341266DE755C5C
MD5 SHA1 SHA512 TLSH

Submit Download

ScaryConsole.ps1

Path C:\Users\Admin\AppData\Local\Temp\PrankSim_3cf414fdbe324a6a8597da8ccdba4e2d\ScaryConsole.ps1
Size 1KB
SHA256 fccf5cd2c5b625e7d01d05a30c837ae8107a1e1366390a408d92608699f460a5
MD5 c8ca3c47c5989c1224615ecff52edb62
SHA1 592cbee8d7ad3920c35c8678ee7c9411f271da4c
SHA512 cc47419f586c5ff233309f161fd5325bd9d1c562832b13fbfbb50b31673e76361f9747bcc602b4cd5a5b16a6b53fcb53993b9db3dad8b235fe997802efcfcde8
TLSH
T1B831B733D845003D837316EA84726108FD47593745769DDEF0BE815873C5628A363E62
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_rxf2ud3k.y5a.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rxf2ud3k.y5a.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2368-110-0x000002201F680000-0x000002201F72F000-memory.dmp

Download

memory/2368-111-0x000002201FB20000-0x000002201FB2C000-memory.dmp

Download

memory/2368-112-0x000002201FC90000-0x000002201FCA2000-memory.dmp

Download

memory/2808-105-0x000001B832C20000-0x000001B832C30000-memory.dmp

Download

memory/2808-83-0x000001B832C20000-0x000001B832C30000-memory.dmp

Download

memory/2808-108-0x000001B81AAB0000-0x000001B81AAC2000-memory.dmp

Download

memory/2808-109-0x000001B832C20000-0x000001B832C30000-memory.dmp

Download

memory/2808-107-0x000001B81AA00000-0x000001B81AAAF000-memory.dmp

Download

memory/2808-106-0x000001B81A500000-0x000001B81A50C000-memory.dmp

Download

memory/2808-104-0x000001B832C20000-0x000001B832C30000-memory.dmp

Download

memory/2808-91-0x000001B832C20000-0x000001B832C30000-memory.dmp

Download

memory/2808-90-0x000001B832CA0000-0x000001B832CC2000-memory.dmp

Download

memory/2808-82-0x000001B832C20000-0x000001B832C30000-memory.dmp

Download

memory/5012-71-0x0000029877F80000-0x0000029877FA0000-memory.dmp

Download

memory/5012-5-0x00000257DDD50000-0x00000257DE9E0000-memory.dmp

Download

memory/5012-39-0x00000257DCAF0000-0x00000257DCB20000-memory.dmp

Download

memory/5012-29-0x00000257DCA90000-0x00000257DCAB0000-memory.dmp

Download

memory/5012-63-0x0000029877640000-0x0000029877670000-memory.dmp

Download

memory/5012-43-0x00000257DCFE0000-0x00000257DD020000-memory.dmp

Download

memory/5012-59-0x00000257E0BF0000-0x00000257E0CB0000-memory.dmp

Download

memory/5012-51-0x00000257DCF80000-0x00000257DCF90000-memory.dmp

Download

memory/5012-103-0x00000298783D0000-0x000002987847F000-memory.dmp

Download

memory/5012-75-0x0000029878540000-0x0000029878590000-memory.dmp

Download

memory/5012-67-0x0000029877670000-0x0000029877690000-memory.dmp

Download

memory/5012-13-0x00000257DC980000-0x00000257DC9A0000-memory.dmp

Download

memory/5012-17-0x00000298759C0000-0x0000029875CA0000-memory.dmp

Download

memory/5012-21-0x00000257DC9E0000-0x00000257DCA00000-memory.dmp

Download

memory/5012-25-0x00000257DCA50000-0x00000257DCA70000-memory.dmp

Download

memory/5012-55-0x00000257DD060000-0x00000257DD070000-memory.dmp

Download

memory/5012-47-0x00000257DEE50000-0x00000257DEFD0000-memory.dmp

Download

memory/5012-33-0x00000257DCAB0000-0x00000257DCAD0000-memory.dmp

Download

memory/5012-11-0x00000257DFD00000-0x00000257E09F0000-memory.dmp

Download