dc8e56607a3db0ffb93fad7964d9f59e2f58a79fb56db066ce345f78273bbf63

Analysis

max time kernel
598s
max time network
414s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
toomanyping.bat
Size 6KB
Sample260511-thrdbadz9x
SHA256 dc8e56607a3db0ffb93fad7964d9f59e2f58a79fb56db066ce345f78273bbf63
MD5 194d1f9ee39cacadb6f20975f1560df0
SHA1 1f08d2cff0ca34d03df5de1f3910d5f1f7c1fa69
SHA512 4274c1a993a7ec756d4b89046198a17e4adfb3d50b1da916561c129da239923def2e159701c07159b3faeedb93e731294cfc531a798665f0d9fa962bae1dd508
SSDEEP 96:QcnEksJcnEksJcnEksJcnEksJcnEksJcnEksJcnEksJcnEksJcnEksJcnEksJcnb:b
TLSH
T183E1C2C71D5E70F4497C7968917837A6E92FE22F4E06A544440F3530241FE92F7B9AD4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4124	PING.EXE
5344	PING.EXE
5316	PING.EXE
5136	PING.EXE
5280	PING.EXE
3080	PING.EXE
1548	PING.EXE
3184	PING.EXE
2456	PING.EXE
4084	PING.EXE
1912	PING.EXE
5832	PING.EXE
1032	PING.EXE
5168	PING.EXE
1108	PING.EXE
3320	PING.EXE
5156	PING.EXE
4204	PING.EXE
5484	PING.EXE
2452	PING.EXE
4840	PING.EXE
5680	PING.EXE
5160	PING.EXE
2156	PING.EXE
1040	PING.EXE
5808	PING.EXE
3776	PING.EXE
1060	PING.EXE
4552	PING.EXE
2116	PING.EXE
3944	PING.EXE
4016	PING.EXE
2632	cmd.exe
5200	PING.EXE
1660	PING.EXE
4468	PING.EXE
1984	PING.EXE
5008	PING.EXE
4128	PING.EXE
5168	PING.EXE
2716	PING.EXE
4104	PING.EXE
5212	PING.EXE
1732	PING.EXE
1704	PING.EXE
4744	PING.EXE
4660	PING.EXE
5932	PING.EXE
4624	PING.EXE
6088	PING.EXE
4248	PING.EXE
5548	PING.EXE
4604	PING.EXE
2608	PING.EXE
2324	PING.EXE
2172	PING.EXE
5308	PING.EXE
1736	PING.EXE
1228	PING.EXE
5112	PING.EXE
2852	PING.EXE
4960	PING.EXE
2092	PING.EXE
4984	PING.EXE

Delays execution with timeout.exe 11 IoCs

defense_evasion

pid	Process
5232	timeout.exe
3428	timeout.exe
3276	timeout.exe
1272	timeout.exe
2284	timeout.exe
5932	timeout.exe
5344	timeout.exe
4004	timeout.exe
5088	timeout.exe
3484	timeout.exe
1768	timeout.exe

Kills process with taskkill 48 IoCs

defense_evasion

pid	Process
5348	taskkill.exe
1048	taskkill.exe
5300	taskkill.exe
1604	taskkill.exe
2524	taskkill.exe
952	taskkill.exe
944	taskkill.exe
6028	taskkill.exe
2828	taskkill.exe
5564	taskkill.exe
2220	taskkill.exe
6008	taskkill.exe
4376	taskkill.exe
4572	taskkill.exe
3676	taskkill.exe
5856	taskkill.exe
408	taskkill.exe
3440	taskkill.exe
2892	taskkill.exe
6084	taskkill.exe
2892	taskkill.exe
3408	taskkill.exe
5196	taskkill.exe
2708	taskkill.exe
2944	taskkill.exe
2428	taskkill.exe
1396	taskkill.exe
4712	taskkill.exe
4460	taskkill.exe
1448	taskkill.exe
3388	taskkill.exe
3428	taskkill.exe
3676	taskkill.exe
4940	taskkill.exe
1556	taskkill.exe
5984	taskkill.exe
5364	taskkill.exe
5508	taskkill.exe
3436	taskkill.exe
5076	taskkill.exe
5632	taskkill.exe
2520	taskkill.exe
3844	taskkill.exe
2772	taskkill.exe
5192	taskkill.exe
484	taskkill.exe
3512	taskkill.exe
964	taskkill.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
5960	PING.EXE
5680	PING.EXE
2116	PING.EXE
1704	PING.EXE
2156	PING.EXE
5212	PING.EXE
1040	PING.EXE
2172	PING.EXE
1548	PING.EXE
4840	PING.EXE
1032	PING.EXE
1252	PING.EXE
2560	PING.EXE
2040	PING.EXE
4952	PING.EXE
5484	PING.EXE
3644	PING.EXE
1736	PING.EXE
5344	PING.EXE
4084	PING.EXE
3184	PING.EXE
4852	PING.EXE
3672	PING.EXE
4552	PING.EXE
5316	PING.EXE
2456	PING.EXE
4660	PING.EXE
808	PING.EXE
1984	PING.EXE
2852	PING.EXE
5168	PING.EXE
4960	PING.EXE
3308	PING.EXE
1108	PING.EXE
5308	PING.EXE
5160	PING.EXE
5156	PING.EXE
4248	PING.EXE
5636	PING.EXE
3596	PING.EXE
4604	PING.EXE
5136	PING.EXE
5420	PING.EXE
5832	PING.EXE
5808	PING.EXE
5112	PING.EXE
4128	PING.EXE
5456	PING.EXE
5200	PING.EXE
4468	PING.EXE
5168	PING.EXE
4300	PING.EXE
1732	PING.EXE
5776	PING.EXE
3776	PING.EXE
3320	PING.EXE
1580	PING.EXE
4104	PING.EXE
2324	PING.EXE
1912	PING.EXE
3944	PING.EXE
2340	PING.EXE
4984	PING.EXE
4696	PING.EXE

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	944	taskkill.exe
Token: SeDebugPrivilege	4712	taskkill.exe
Token: SeDebugPrivilege	5984	taskkill.exe
Token: SeDebugPrivilege	3408	taskkill.exe
Token: SeDebugPrivilege	2944	taskkill.exe
Token: SeDebugPrivilege	5364	taskkill.exe
Token: SeDebugPrivilege	5196	taskkill.exe
Token: SeDebugPrivilege	2708	taskkill.exe
Token: SeDebugPrivilege	5348	taskkill.exe
Token: SeDebugPrivilege	3844	taskkill.exe
Token: SeDebugPrivilege	2892	taskkill.exe
Token: SeDebugPrivilege	5508	taskkill.exe
Token: SeDebugPrivilege	964	taskkill.exe
Token: SeDebugPrivilege	6008	taskkill.exe
Token: SeDebugPrivilege	4376	taskkill.exe
Token: SeDebugPrivilege	4460	taskkill.exe
Token: SeDebugPrivilege	3436	taskkill.exe
Token: SeDebugPrivilege	5856	taskkill.exe
Token: SeDebugPrivilege	4572	taskkill.exe
Token: SeDebugPrivilege	3676	taskkill.exe
Token: SeDebugPrivilege	2428	taskkill.exe
Token: SeDebugPrivilege	6084	taskkill.exe
Token: SeDebugPrivilege	5076	taskkill.exe
Token: SeDebugPrivilege	1448	taskkill.exe
Token: SeDebugPrivilege	2828	taskkill.exe
Token: SeDebugPrivilege	408	taskkill.exe
Token: SeDebugPrivilege	2772	taskkill.exe
Token: SeDebugPrivilege	6028	taskkill.exe
Token: SeDebugPrivilege	3428	taskkill.exe
Token: SeDebugPrivilege	5300	taskkill.exe
Token: SeDebugPrivilege	3388	taskkill.exe
Token: SeDebugPrivilege	1048	taskkill.exe
Token: SeDebugPrivilege	5564	taskkill.exe
Token: SeDebugPrivilege	3440	taskkill.exe
Token: SeDebugPrivilege	3676	taskkill.exe
Token: SeDebugPrivilege	4940	taskkill.exe
Token: SeDebugPrivilege	1604	taskkill.exe
Token: SeDebugPrivilege	1396	taskkill.exe
Token: SeDebugPrivilege	2892	taskkill.exe
Token: SeDebugPrivilege	2524	taskkill.exe
Token: SeDebugPrivilege	952	taskkill.exe
Token: SeDebugPrivilege	5632	taskkill.exe
Token: SeDebugPrivilege	484	taskkill.exe
Token: SeDebugPrivilege	5192	taskkill.exe
Token: SeDebugPrivilege	2520	taskkill.exe
Token: SeDebugPrivilege	1556	taskkill.exe
Token: SeDebugPrivilege	2220	taskkill.exe
Token: SeDebugPrivilege	3512	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 3184	2632	cmd.exe	80
PID 2632 wrote to memory of 5960	2632	cmd.exe	81
PID 2632 wrote to memory of 5776	2632	cmd.exe	82
PID 2632 wrote to memory of 5484	2632	cmd.exe	85
PID 2632 wrote to memory of 5008	2632	cmd.exe	86
PID 2632 wrote to memory of 5112	2632	cmd.exe	87
PID 2632 wrote to memory of 4128	2632	cmd.exe	88
PID 2632 wrote to memory of 4248	2632	cmd.exe	89
PID 2632 wrote to memory of 3408	2632	cmd.exe	90
PID 2632 wrote to memory of 5984	2632	cmd.exe	91
PID 2632 wrote to memory of 944	2632	cmd.exe	93
PID 2632 wrote to memory of 4712	2632	cmd.exe	95
PID 2632 wrote to memory of 5932	2632	cmd.exe	103
PID 2632 wrote to memory of 3776	2632	cmd.exe	105
PID 2632 wrote to memory of 2852	2632	cmd.exe	106
PID 2632 wrote to memory of 5168	2632	cmd.exe	108
PID 2632 wrote to memory of 4660	2632	cmd.exe	109
PID 2632 wrote to memory of 5636	2632	cmd.exe	110
PID 2632 wrote to memory of 5200	2632	cmd.exe	111
PID 2632 wrote to memory of 4960	2632	cmd.exe	112
PID 2632 wrote to memory of 1060	2632	cmd.exe	114
PID 2632 wrote to memory of 2944	2632	cmd.exe	115
PID 2632 wrote to memory of 5364	2632	cmd.exe	117
PID 2632 wrote to memory of 2708	2632	cmd.exe	119
PID 2632 wrote to memory of 5196	2632	cmd.exe	120
PID 2632 wrote to memory of 5344	2632	cmd.exe	121
PID 2632 wrote to memory of 2092	2632	cmd.exe	129
PID 2632 wrote to memory of 2340	2632	cmd.exe	130
PID 2632 wrote to memory of 1660	2632	cmd.exe	131
PID 2632 wrote to memory of 1228	2632	cmd.exe	134
PID 2632 wrote to memory of 3308	2632	cmd.exe	136
PID 2632 wrote to memory of 5456	2632	cmd.exe	138
PID 2632 wrote to memory of 1704	2632	cmd.exe	139
PID 2632 wrote to memory of 3644	2632	cmd.exe	140
PID 2632 wrote to memory of 2892	2632	cmd.exe	141
PID 2632 wrote to memory of 5348	2632	cmd.exe	142
PID 2632 wrote to memory of 3844	2632	cmd.exe	143
PID 2632 wrote to memory of 5508	2632	cmd.exe	144
PID 2632 wrote to memory of 5232	2632	cmd.exe	145
PID 2632 wrote to memory of 3596	2632	cmd.exe	153
PID 2632 wrote to memory of 4992	2632	cmd.exe	154
PID 2632 wrote to memory of 4124	2632	cmd.exe	155
PID 2632 wrote to memory of 2452	2632	cmd.exe	156
PID 2632 wrote to memory of 4852	2632	cmd.exe	158
PID 2632 wrote to memory of 4468	2632	cmd.exe	160
PID 2632 wrote to memory of 4840	2632	cmd.exe	162
PID 2632 wrote to memory of 4744	2632	cmd.exe	163
PID 2632 wrote to memory of 4376	2632	cmd.exe	164
PID 2632 wrote to memory of 4460	2632	cmd.exe	165
PID 2632 wrote to memory of 6008	2632	cmd.exe	166
PID 2632 wrote to memory of 964	2632	cmd.exe	167
PID 2632 wrote to memory of 3428	2632	cmd.exe	168
PID 2632 wrote to memory of 1108	2632	cmd.exe	177
PID 2632 wrote to memory of 3500	2632	cmd.exe	178
PID 2632 wrote to memory of 3672	2632	cmd.exe	179
PID 2632 wrote to memory of 4552	2632	cmd.exe	182
PID 2632 wrote to memory of 5932	2632	cmd.exe	183
PID 2632 wrote to memory of 4984	2632	cmd.exe	184
PID 2632 wrote to memory of 3320	2632	cmd.exe	185
PID 2632 wrote to memory of 1580	2632	cmd.exe	187
PID 2632 wrote to memory of 4572	2632	cmd.exe	192
PID 2632 wrote to memory of 3436	2632	cmd.exe	193
PID 2632 wrote to memory of 5856	2632	cmd.exe	194
PID 2632 wrote to memory of 3676	2632	cmd.exe	195

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\toomanyping.bat"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3184
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:5960
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:5776
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5484
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5008
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5112
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4128
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4248
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3408
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5984
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:944
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4712
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5932
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3776
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2852
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5168
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4660
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:5636
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5200
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4960
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1060
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5364
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5196
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5344
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2092
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:2340
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1660
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1228
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:3308
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:5456
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1704
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:3644
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5348
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3844
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5508
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5232
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:3596
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:4992
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4124
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2452
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:4852
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4468
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4840
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4744
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4376
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4460
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6008
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:964
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3428
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1108
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:3500
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:3672
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4552
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5932
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4984
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3320
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:1580
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4572
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3436
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5856
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3676
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4004
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5680
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5308
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5160
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:2608
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:1252
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1736
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5344
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1032
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6084
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1448
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5076
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2428
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5088
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:4360
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5316
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2716
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5548
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5168
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:4696
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2156
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:3944
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:408
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2828
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2772
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6028
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3484
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4604
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:5532
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:5396
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:808
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4624
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6088
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:4300
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2116
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5300
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3428
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1048
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3388
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3276
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:5900
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:2560
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2456
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5136
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:3436
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4104
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:5692
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5156
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5564
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3440
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4940
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3676
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1272
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:2040
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:2840
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5212
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:764
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1040
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5280
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4084
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:3708
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2524
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1604
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1396
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2284
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2608
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4204
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:5420
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1732
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3080
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  PID:6072
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1984
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2324
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5632
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:952
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:484
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5192
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1768
- C:\Windows\system32\PING.EXE
  ping google.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1912
- C:\Windows\system32\PING.EXE
  ping yandex.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2172
- C:\Windows\system32\PING.EXE
  ping dzen.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5808
- C:\Windows\system32\PING.EXE
  ping ya.ru -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5832
- C:\Windows\system32\PING.EXE
  ping example.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1548
- C:\Windows\system32\PING.EXE
  ping example.org -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - Runs ping.exe
  PID:4952
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4016
- C:\Windows\system32\PING.EXE
  ping apponfly.com -n 30 -l 1024 -i 255 -w 9999
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3944
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2220
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1556
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3512
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/408-31-0x00000178F5270000-0x00000178F52CD000-memory.dmp

Download

memory/484-53-0x000001AA45900000-0x000001AA4595D000-memory.dmp

Download

memory/944-0-0x000001F1A2280000-0x000001F1A22DD000-memory.dmp

Download

memory/952-50-0x0000021473410000-0x000002147346D000-memory.dmp

Download

memory/964-15-0x0000020723140000-0x000002072319D000-memory.dmp

Download

memory/1048-37-0x0000015E98720000-0x0000015E9877D000-memory.dmp

Download

memory/1272-44-0x0000019E46530000-0x0000019E4658D000-memory.dmp

Download

memory/1396-46-0x0000015BC2A40000-0x0000015BC2A9D000-memory.dmp

Download

memory/1448-27-0x0000017F79BB0000-0x0000017F79C0D000-memory.dmp

Download

memory/1556-58-0x000001CA5F1C0000-0x000001CA5F21D000-memory.dmp

Download

memory/1604-47-0x00000230470B0000-0x000002304710D000-memory.dmp

Download

memory/1768-54-0x000001BDE6690000-0x000001BDE66ED000-memory.dmp

Download

memory/2220-56-0x00000129F3F80000-0x00000129F3FDD000-memory.dmp

Download

memory/2284-49-0x00000248264B0000-0x000002482650D000-memory.dmp

Download

memory/2428-26-0x0000028B249F0000-0x0000028B24A4D000-memory.dmp

Download

memory/2520-57-0x0000021FF8170000-0x0000021FF81CD000-memory.dmp

Download

memory/2524-45-0x0000015579020000-0x000001557907D000-memory.dmp

Download

memory/2708-7-0x0000020E27E50000-0x0000020E27EAD000-memory.dmp

Download

memory/2772-33-0x00000178B1BA0000-0x00000178B1BFD000-memory.dmp

Download

memory/2828-30-0x000002C1389A0000-0x000002C1389FD000-memory.dmp

Download

memory/2892-10-0x000001CDD1650000-0x000001CDD16AD000-memory.dmp

Download

memory/2892-48-0x0000021CE8350000-0x0000021CE83AD000-memory.dmp

Download

memory/2944-5-0x00000165B0970000-0x00000165B09CD000-memory.dmp

Download

memory/3276-39-0x00000234518C0000-0x000002345191D000-memory.dmp

Download

memory/3388-38-0x00000291435A0000-0x00000291435FD000-memory.dmp

Download

memory/3408-2-0x0000022399040000-0x000002239909D000-memory.dmp

Download

memory/3428-19-0x0000016046610000-0x000001604666D000-memory.dmp

Download

memory/3428-35-0x00000280721E0000-0x000002807223D000-memory.dmp

Download

memory/3436-20-0x00000170D34D0000-0x00000170D352D000-memory.dmp

Download

memory/3440-40-0x0000027C8CD70000-0x0000027C8CDCD000-memory.dmp

Download

memory/3484-34-0x0000022B32710000-0x0000022B3276D000-memory.dmp

Download

memory/3512-55-0x000001EC18DC0000-0x000001EC18E1D000-memory.dmp

Download

memory/3676-41-0x000001B6D9A90000-0x000001B6D9AED000-memory.dmp

Download

memory/3676-23-0x000001C98EC90000-0x000001C98ECED000-memory.dmp

Download

memory/3844-13-0x000001BE82BA0000-0x000001BE82BFD000-memory.dmp

Download

memory/4004-24-0x000001E419900000-0x000001E41995D000-memory.dmp

Download

memory/4376-18-0x000001D870360000-0x000001D8703BD000-memory.dmp

Download

memory/4460-17-0x00000195880A0000-0x00000195880FD000-memory.dmp

Download

memory/4572-21-0x000001B505720000-0x000001B50577D000-memory.dmp

Download

memory/4712-3-0x0000024FE6BB0000-0x0000024FE6C0D000-memory.dmp

Download

memory/4940-43-0x000002DFF5730000-0x000002DFF578D000-memory.dmp

Download

memory/5076-28-0x000001B032C90000-0x000001B032CED000-memory.dmp

Download

memory/5088-29-0x000001E6A6700000-0x000001E6A675D000-memory.dmp

Download

memory/5192-52-0x000001D9272B0000-0x000001D92730D000-memory.dmp

Download

memory/5196-8-0x000001DF7C3C0000-0x000001DF7C41D000-memory.dmp

Download

memory/5232-14-0x000001A54BC80000-0x000001A54BCDD000-memory.dmp

Download

memory/5300-36-0x00000175D72D0000-0x00000175D732D000-memory.dmp

Download

memory/5344-9-0x0000023253180000-0x00000232531DD000-memory.dmp

Download

memory/5348-11-0x000001D836DB0000-0x000001D836E0D000-memory.dmp

Download

memory/5364-6-0x0000012519830000-0x000001251988D000-memory.dmp

Download

memory/5508-12-0x0000026703900000-0x000002670395D000-memory.dmp

Download

memory/5564-42-0x000001FEEE5F0000-0x000001FEEE64D000-memory.dmp

Download

memory/5632-51-0x000002AD48A80000-0x000002AD48ADD000-memory.dmp

Download

memory/5856-22-0x00000239D9050000-0x00000239D90AD000-memory.dmp

Download

memory/5932-4-0x000001ABE0FC0000-0x000001ABE101D000-memory.dmp

Download

memory/5984-1-0x0000020446DF0000-0x0000020446E4D000-memory.dmp

Download

memory/6008-16-0x000001FFFD6F0000-0x000001FFFD74D000-memory.dmp

Download

memory/6028-32-0x000001DDD99B0000-0x000001DDD9A0D000-memory.dmp

Download

memory/6084-25-0x0000026874DC0000-0x0000026874E1D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads