dc8e56607a3db0ffb93fad7964d9f59e2f58a79fb56db066ce345f78273bbf63

Analysis

user interaction
yes
max time kernel
598s
max time network
559s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
toomanyping.bat
Size 6KB
Sample260511-thrdbadz9x
SHA256 dc8e56607a3db0ffb93fad7964d9f59e2f58a79fb56db066ce345f78273bbf63
MD5 194d1f9ee39cacadb6f20975f1560df0
SHA1 1f08d2cff0ca34d03df5de1f3910d5f1f7c1fa69
SHA512 4274c1a993a7ec756d4b89046198a17e4adfb3d50b1da916561c129da239923def2e159701c07159b3faeedb93e731294cfc531a798665f0d9fa962bae1dd508
SSDEEP 96:QcnEksJcnEksJcnEksJcnEksJcnEksJcnEksJcnEksJcnEksJcnEksJcnEksJcnb:b
TLSH
T183E1C2C71D5E70F4497C7968917837A6E92FE22F4E06A544440F3530241FE92F7B9AD4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4028	PING.EXE
2824	PING.EXE
3628	PING.EXE
3748	PING.EXE
2052	PING.EXE
4616	PING.EXE
2260	PING.EXE
4316	PING.EXE
3312	PING.EXE
4528	PING.EXE
4596	PING.EXE
3260	PING.EXE
3752	PING.EXE
720	cmd.exe
4076	PING.EXE
4604	PING.EXE
532	PING.EXE
116	PING.EXE
3708	PING.EXE
2144	PING.EXE
4108	PING.EXE
1540	PING.EXE
1604	PING.EXE
3000	PING.EXE
4192	PING.EXE
4368	PING.EXE
1184	PING.EXE
1544	PING.EXE
636	PING.EXE
4416	PING.EXE
3076	PING.EXE
4284	PING.EXE
2256	PING.EXE
2804	PING.EXE
3712	PING.EXE
4352	PING.EXE
4288	PING.EXE
3444	PING.EXE
4620	PING.EXE
920	PING.EXE
3084	PING.EXE
4516	PING.EXE
2472	PING.EXE
4748	PING.EXE
3400	PING.EXE
2964	PING.EXE
4660	PING.EXE
2228	PING.EXE
2376	PING.EXE
948	PING.EXE
3788	PING.EXE
3088	PING.EXE
2940	PING.EXE
4124	PING.EXE
3444	PING.EXE
1896	PING.EXE
4260	PING.EXE
1084	PING.EXE
532	PING.EXE
4908	PING.EXE
3952	PING.EXE
812	PING.EXE
1368	PING.EXE
2120	PING.EXE

Delays execution with timeout.exe 11 IoCs

defense_evasion

pid	Process
5112	timeout.exe
4200	timeout.exe
4420	timeout.exe
2632	timeout.exe
3772	timeout.exe
3416	timeout.exe
3004	timeout.exe
3452	timeout.exe
3116	timeout.exe
3316	timeout.exe
1964	timeout.exe

Kills process with taskkill 48 IoCs

defense_evasion

pid	Process
3156	taskkill.exe
2596	taskkill.exe
4152	taskkill.exe
5088	taskkill.exe
4252	taskkill.exe
2560	taskkill.exe
5012	taskkill.exe
2280	taskkill.exe
1368	taskkill.exe
4124	taskkill.exe
3764	taskkill.exe
1668	taskkill.exe
3736	taskkill.exe
2480	taskkill.exe
708	taskkill.exe
3936	taskkill.exe
1560	taskkill.exe
4824	taskkill.exe
4204	taskkill.exe
3252	taskkill.exe
1540	taskkill.exe
2364	taskkill.exe
2132	taskkill.exe
4032	taskkill.exe
4708	taskkill.exe
1464	taskkill.exe
2264	taskkill.exe
4548	taskkill.exe
3788	taskkill.exe
3508	taskkill.exe
3640	taskkill.exe
2528	taskkill.exe
2972	taskkill.exe
3376	taskkill.exe
176	taskkill.exe
4744	taskkill.exe
3764	taskkill.exe
3036	taskkill.exe
4300	taskkill.exe
2292	taskkill.exe
2932	taskkill.exe
3920	taskkill.exe
3156	taskkill.exe
1228	taskkill.exe
3912	taskkill.exe
2832	taskkill.exe
4492	taskkill.exe
5012	taskkill.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
2824	PING.EXE
4076	PING.EXE
920	PING.EXE
4108	PING.EXE
4028	PING.EXE
4192	PING.EXE
4836	PING.EXE
3492	PING.EXE
3736	PING.EXE
4660	PING.EXE
4416	PING.EXE
532	PING.EXE
1948	PING.EXE
980	PING.EXE
3788	PING.EXE
4600	PING.EXE
2052	PING.EXE
4604	PING.EXE
1064	PING.EXE
3628	PING.EXE
3952	PING.EXE
2964	PING.EXE
3712	PING.EXE
1040	PING.EXE
3000	PING.EXE
3076	PING.EXE
3312	PING.EXE
3708	PING.EXE
1184	PING.EXE
4564	PING.EXE
2472	PING.EXE
1540	PING.EXE
3084	PING.EXE
3436	PING.EXE
1084	PING.EXE
4260	PING.EXE
2844	PING.EXE
4464	PING.EXE
3736	PING.EXE
2016	PING.EXE
176	PING.EXE
532	PING.EXE
4516	PING.EXE
3344	PING.EXE
2256	PING.EXE
4748	PING.EXE
4596	PING.EXE
4616	PING.EXE
2260	PING.EXE
1896	PING.EXE
4284	PING.EXE
4528	PING.EXE
2192	PING.EXE
4352	PING.EXE
2376	PING.EXE
116	PING.EXE
4756	PING.EXE
3400	PING.EXE
4212	PING.EXE
1544	PING.EXE
4908	PING.EXE
2144	PING.EXE
4468	PING.EXE
4240	PING.EXE

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	3764	taskkill.exe
Token: SeDebugPrivilege	4824	taskkill.exe
Token: SeDebugPrivilege	4548	taskkill.exe
Token: SeDebugPrivilege	3912	taskkill.exe
Token: SeDebugPrivilege	2972	taskkill.exe
Token: SeDebugPrivilege	3036	taskkill.exe
Token: SeDebugPrivilege	4204	taskkill.exe
Token: SeDebugPrivilege	2528	taskkill.exe
Token: SeDebugPrivilege	2932	taskkill.exe
Token: SeDebugPrivilege	2292	taskkill.exe
Token: SeDebugPrivilege	4300	taskkill.exe
Token: SeDebugPrivilege	4124	taskkill.exe
Token: SeDebugPrivilege	2832	taskkill.exe
Token: SeDebugPrivilege	3788	taskkill.exe
Token: SeDebugPrivilege	4492	taskkill.exe
Token: SeDebugPrivilege	3252	taskkill.exe
Token: SeDebugPrivilege	3376	taskkill.exe
Token: SeDebugPrivilege	3156	taskkill.exe
Token: SeDebugPrivilege	1540	taskkill.exe
Token: SeDebugPrivilege	5012	taskkill.exe
Token: SeDebugPrivilege	4152	taskkill.exe
Token: SeDebugPrivilege	176	taskkill.exe
Token: SeDebugPrivilege	2596	taskkill.exe
Token: SeDebugPrivilege	3920	taskkill.exe
Token: SeDebugPrivilege	3640	taskkill.exe
Token: SeDebugPrivilege	3156	taskkill.exe
Token: SeDebugPrivilege	3764	taskkill.exe
Token: SeDebugPrivilege	2364	taskkill.exe
Token: SeDebugPrivilege	4252	taskkill.exe
Token: SeDebugPrivilege	2560	taskkill.exe
Token: SeDebugPrivilege	1668	taskkill.exe
Token: SeDebugPrivilege	4708	taskkill.exe
Token: SeDebugPrivilege	4744	taskkill.exe
Token: SeDebugPrivilege	3736	taskkill.exe
Token: SeDebugPrivilege	5012	taskkill.exe
Token: SeDebugPrivilege	2280	taskkill.exe
Token: SeDebugPrivilege	1464	taskkill.exe
Token: SeDebugPrivilege	2132	taskkill.exe
Token: SeDebugPrivilege	2480	taskkill.exe
Token: SeDebugPrivilege	5088	taskkill.exe
Token: SeDebugPrivilege	708	taskkill.exe
Token: SeDebugPrivilege	1368	taskkill.exe
Token: SeDebugPrivilege	2264	taskkill.exe
Token: SeDebugPrivilege	1228	taskkill.exe
Token: SeDebugPrivilege	1560	taskkill.exe
Token: SeDebugPrivilege	3936	taskkill.exe
Token: SeDebugPrivilege	4032	taskkill.exe
Token: SeDebugPrivilege	3508	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 4564	720	cmd.exe	84
PID 720 wrote to memory of 5016	720	cmd.exe	86
PID 720 wrote to memory of 3572	720	cmd.exe	87
PID 720 wrote to memory of 2472	720	cmd.exe	88
PID 720 wrote to memory of 4836	720	cmd.exe	90
PID 720 wrote to memory of 2824	720	cmd.exe	92
PID 720 wrote to memory of 532	720	cmd.exe	93
PID 720 wrote to memory of 4528	720	cmd.exe	95
PID 720 wrote to memory of 3912	720	cmd.exe	96
PID 720 wrote to memory of 4548	720	cmd.exe	97
PID 720 wrote to memory of 3764	720	cmd.exe	99
PID 720 wrote to memory of 4824	720	cmd.exe	100
PID 720 wrote to memory of 5112	720	cmd.exe	101
PID 720 wrote to memory of 4076	720	cmd.exe	111
PID 720 wrote to memory of 4368	720	cmd.exe	118
PID 720 wrote to memory of 3628	720	cmd.exe	119
PID 720 wrote to memory of 3492	720	cmd.exe	120
PID 720 wrote to memory of 1184	720	cmd.exe	122
PID 720 wrote to memory of 2256	720	cmd.exe	124
PID 720 wrote to memory of 4288	720	cmd.exe	126
PID 720 wrote to memory of 3344	720	cmd.exe	127
PID 720 wrote to memory of 3036	720	cmd.exe	129
PID 720 wrote to memory of 2972	720	cmd.exe	130
PID 720 wrote to memory of 2528	720	cmd.exe	131
PID 720 wrote to memory of 4204	720	cmd.exe	132
PID 720 wrote to memory of 4200	720	cmd.exe	133
PID 720 wrote to memory of 4260	720	cmd.exe	141
PID 720 wrote to memory of 1544	720	cmd.exe	142
PID 720 wrote to memory of 4908	720	cmd.exe	143
PID 720 wrote to memory of 4620	720	cmd.exe	145
PID 720 wrote to memory of 3708	720	cmd.exe	146
PID 720 wrote to memory of 4748	720	cmd.exe	147
PID 720 wrote to memory of 3444	720	cmd.exe	149
PID 720 wrote to memory of 2844	720	cmd.exe	150
PID 720 wrote to memory of 4300	720	cmd.exe	153
PID 720 wrote to memory of 2932	720	cmd.exe	154
PID 720 wrote to memory of 2292	720	cmd.exe	155
PID 720 wrote to memory of 4124	720	cmd.exe	156
PID 720 wrote to memory of 4420	720	cmd.exe	157
PID 720 wrote to memory of 1824	720	cmd.exe	165
PID 720 wrote to memory of 1948	720	cmd.exe	166
PID 720 wrote to memory of 980	720	cmd.exe	167
PID 720 wrote to memory of 4212	720	cmd.exe	169
PID 720 wrote to memory of 5048	720	cmd.exe	170
PID 720 wrote to memory of 920	720	cmd.exe	172
PID 720 wrote to memory of 3736	720	cmd.exe	174
PID 720 wrote to memory of 4464	720	cmd.exe	175
PID 720 wrote to memory of 3788	720	cmd.exe	176
PID 720 wrote to memory of 4492	720	cmd.exe	177
PID 720 wrote to memory of 2832	720	cmd.exe	178
PID 720 wrote to memory of 3252	720	cmd.exe	179
PID 720 wrote to memory of 2632	720	cmd.exe	180
PID 720 wrote to memory of 2144	720	cmd.exe	189
PID 720 wrote to memory of 3628	720	cmd.exe	191
PID 720 wrote to memory of 3952	720	cmd.exe	192
PID 720 wrote to memory of 3748	720	cmd.exe	194
PID 720 wrote to memory of 3260	720	cmd.exe	195
PID 720 wrote to memory of 4596	720	cmd.exe	196
PID 720 wrote to memory of 948	720	cmd.exe	197
PID 720 wrote to memory of 4108	720	cmd.exe	199
PID 720 wrote to memory of 3156	720	cmd.exe	201
PID 720 wrote to memory of 5012	720	cmd.exe	203
PID 720 wrote to memory of 1540	720	cmd.exe	204
PID 720 wrote to memory of 3376	720	cmd.exe	205

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\toomanyping.bat"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:720
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:4564
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:5016
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:3572
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2472
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:4836
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2824
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:532
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4528
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3912
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4548
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3764
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4824
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5112
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4076
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4368
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:3628
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:3492
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1184
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2256
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4288
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:3344
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2972
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2528
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4204
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4200
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4260
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1544
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4908
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4620
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3708
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4748
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3444
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:2844
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4300
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2292
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4124
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4420
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:1824
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:1948
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:980
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:4212
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:5048
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:920
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:3736
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:4464
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3788
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4492
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2832
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3252
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2632
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2144
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3628
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3952
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3748
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3260
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4596
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:948
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4108
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3156
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1540
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3376
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3772
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:2068
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:2016
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:4240
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2052
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:4600
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3788
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:1788
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:812
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3920
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:176
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4152
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3416
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:3736
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:4756
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1540
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3084
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:3436
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4604
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3400
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2804
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3640
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3156
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2364
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3764
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3004
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:4468
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:176
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:1064
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3712
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:532
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:2192
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2964
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:2872
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1668
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4708
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4252
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3452
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1368
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4028
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4660
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:4196
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:644
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4616
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1084
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3088
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2280
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3736
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4744
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3116
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:4240
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4516
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4352
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:1040
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:636
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2260
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1604
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2228
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5088
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2132
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2480
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1464
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3316
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2940
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3000
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4192
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2376
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2120
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3444
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4124
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4416
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:708
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2264
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1228
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1368
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1964
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:2792
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4316
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3752
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1896
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3076
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3312
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4284
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:116
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4032
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3508
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/176-28-0x00000224A4400000-0x00000224A4430000-memory.dmp

Download

memory/708-50-0x000001D431300000-0x000001D431330000-memory.dmp

Download

memory/1228-51-0x00000218A8020000-0x00000218A8050000-memory.dmp

Download

memory/1368-52-0x0000021E50830000-0x0000021E50860000-memory.dmp

Download

memory/1464-48-0x000002009A520000-0x000002009A550000-memory.dmp

Download

memory/1540-20-0x000001F7C5910000-0x000001F7C5940000-memory.dmp

Download

memory/1560-55-0x0000022465C70000-0x0000022465CA0000-memory.dmp

Download

memory/1668-35-0x00000132FACE0000-0x00000132FAD10000-memory.dmp

Download

memory/1964-54-0x0000019F081C0000-0x0000019F081F0000-memory.dmp

Download

memory/2132-47-0x000001A5F4770000-0x000001A5F47A0000-memory.dmp

Download

memory/2264-53-0x00000204AEB30000-0x00000204AEB60000-memory.dmp

Download

memory/2280-43-0x00000206403C0000-0x00000206403F0000-memory.dmp

Download

memory/2292-11-0x000001F188090000-0x000001F1880C0000-memory.dmp

Download

memory/2364-31-0x0000022257BC0000-0x0000022257BF0000-memory.dmp

Download

memory/2480-45-0x00000289A54B0000-0x00000289A54E0000-memory.dmp

Download

memory/2528-8-0x000001A0B1D70000-0x000001A0B1DA0000-memory.dmp

Download

memory/2560-37-0x0000015CAE790000-0x0000015CAE7C0000-memory.dmp

Download

memory/2596-27-0x0000028C79840000-0x0000028C79870000-memory.dmp

Download

memory/2632-19-0x00000282D1660000-0x00000282D1690000-memory.dmp

Download

memory/2832-17-0x000001425F7B0000-0x000001425F7E0000-memory.dmp

Download

memory/2932-13-0x0000027EA60B0000-0x0000027EA60E0000-memory.dmp

Download

memory/2972-5-0x0000021D46120000-0x0000021D46150000-memory.dmp

Download

memory/3004-34-0x000001914B230000-0x000001914B260000-memory.dmp

Download

memory/3036-7-0x000001DB09E10000-0x000001DB09E40000-memory.dmp

Download

memory/3116-44-0x00000254B98A0000-0x00000254B98D0000-memory.dmp

Download

memory/3156-21-0x0000011FD1B70000-0x0000011FD1BA0000-memory.dmp

Download

memory/3156-32-0x0000017FCEF50000-0x0000017FCEF80000-memory.dmp

Download

memory/3252-15-0x00000205D8860000-0x00000205D8890000-memory.dmp

Download

memory/3316-49-0x00000235EE310000-0x00000235EE340000-memory.dmp

Download

memory/3376-22-0x000001FD32380000-0x000001FD323B0000-memory.dmp

Download

memory/3416-29-0x00000190565F0000-0x0000019056620000-memory.dmp

Download

memory/3452-39-0x0000020BEBE30000-0x0000020BEBE60000-memory.dmp

Download

memory/3508-58-0x0000024597360000-0x0000024597390000-memory.dmp

Download

memory/3640-30-0x000002C12CEC0000-0x000002C12CEF0000-memory.dmp

Download

memory/3736-40-0x000002438FCA0000-0x000002438FCD0000-memory.dmp

Download

memory/3764-33-0x0000021194D20000-0x0000021194D50000-memory.dmp

Download

memory/3764-3-0x000001F531D70000-0x000001F531DA0000-memory.dmp

Download

memory/3772-24-0x000001D76F9A0000-0x000001D76F9D0000-memory.dmp

Download

memory/3788-16-0x000001BE55430000-0x000001BE55460000-memory.dmp

Download

memory/3912-0-0x000001F02A160000-0x000001F02A190000-memory.dmp

Download

memory/3920-26-0x000001EB0EFF0000-0x000001EB0F020000-memory.dmp

Download

memory/3936-56-0x0000021D8A110000-0x0000021D8A140000-memory.dmp

Download

memory/4032-57-0x00000244ECD50000-0x00000244ECD80000-memory.dmp

Download

memory/4124-12-0x000001F6DBE00000-0x000001F6DBE30000-memory.dmp

Download

memory/4152-25-0x00000295EA060000-0x00000295EA090000-memory.dmp

Download

memory/4200-9-0x00000281236C0000-0x00000281236F0000-memory.dmp

Download

memory/4204-6-0x000001CEE08E0000-0x000001CEE0910000-memory.dmp

Download

memory/4252-36-0x000002C74F4D0000-0x000002C74F500000-memory.dmp

Download

memory/4300-10-0x0000016BE4320000-0x0000016BE4350000-memory.dmp

Download

memory/4420-14-0x00000202437B0000-0x00000202437E0000-memory.dmp

Download

memory/4492-18-0x000002944AFF0000-0x000002944B020000-memory.dmp

Download

memory/4548-1-0x000002161B680000-0x000002161B6B0000-memory.dmp

Download

memory/4708-38-0x000002757C4C0000-0x000002757C4F0000-memory.dmp

Download

memory/4744-41-0x000002D1F5E80000-0x000002D1F5EB0000-memory.dmp

Download

memory/4824-2-0x0000017BF5BF0000-0x0000017BF5C20000-memory.dmp

Download

memory/5012-23-0x00000149C2700000-0x00000149C2730000-memory.dmp

Download

memory/5012-42-0x000001EAA1840000-0x000001EAA1870000-memory.dmp

Download

memory/5088-46-0x000001EB8D1A0000-0x000001EB8D1D0000-memory.dmp

Download

memory/5112-4-0x00000270ED7C0000-0x00000270ED7F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads