810775c20b109dd2e8106d8dc86c8bd44be89191b1d176f318de0536f2aefa31

Resubmissions

14/10/2026, 09:44

261014-lqp68abs8p

14/10/2026, 09:43

261014-lp8l6sa15x7

Analysis

user interaction
yes
max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 09:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FortniteCheckerv1.exe
Size 3.7MB
Sample261014-lp8l6sa15x
SHA256 810775c20b109dd2e8106d8dc86c8bd44be89191b1d176f318de0536f2aefa31
MD5 e8fb397fd7ffde89bd8e9cb4d9d62501
SHA1 a32c9f976449b62591f302cf3d5badaefbde9c94
SHA512 1cc56c668a669b627a33203634b04dbbdae1d91135fff6a2df95ad58b410c1807a83d21468daab9c389d4cc878bb3614a78e2ab565f42a95ba26b6eb46541207
SSDEEP 49152:4ypFsHuBViNm4lReEIvq6vXhgWVWvAdldddkd1Sd8d7Ydud3dXpUCdfdWdo6l5nG:BT2WlJyvNzsjq
TLSH
T117060893199B0CE6DDD267B4B5CB2239A734FD31CE581A3F9A48C5246C532C4BE2EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices\svchost.exe	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2488	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemServices = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemServices\\svchost.exe"	FortniteCheckerv1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemServices = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemServices\\svchost.exe"	svchost.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2540	cmd.exe
1216	cmd.exe
6000	cmd.exe
3612	cmd.exe
3040	cmd.exe
400	cmd.exe
4952	cmd.exe
2636	cmd.exe
4920	cmd.exe
2932	cmd.exe
5376	cmd.exe
1100	cmd.exe
4868	cmd.exe
5220	cmd.exe
4440	cmd.exe
4320	cmd.exe
2852	cmd.exe
296	cmd.exe
3172	cmd.exe
3984	cmd.exe
4380	cmd.exe
3352	cmd.exe
3652	cmd.exe
4316	cmd.exe
2080	cmd.exe
1052	cmd.exe
3812	cmd.exe
4160	cmd.exe
704	cmd.exe
2384	cmd.exe
5684	cmd.exe
5844	cmd.exe
4280	cmd.exe
2084	cmd.exe
4848	cmd.exe
4488	cmd.exe
292	cmd.exe
5828	cmd.exe
4760	cmd.exe
4164	cmd.exe
5644	cmd.exe
3300	cmd.exe
3264	cmd.exe
2812	cmd.exe
2472	cmd.exe
6120	cmd.exe
4696	cmd.exe
4636	cmd.exe
576	cmd.exe
2876	cmd.exe
3924	cmd.exe
6116	cmd.exe
2392	cmd.exe
2408	cmd.exe
2428	cmd.exe
4892	cmd.exe
5068	cmd.exe
3444	cmd.exe
1232	cmd.exe
4516	cmd.exe
2004	cmd.exe
1632	cmd.exe
1244	cmd.exe
3328	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5512	PING.EXE
4144	cmd.exe
2920	PING.EXE
2080	PING.EXE
292	PING.EXE
3636	cmd.exe
5016	cmd.exe
5096	cmd.exe
1916	PING.EXE
4908	PING.EXE
2260	cmd.exe
1244	PING.EXE
1572	cmd.exe
832	PING.EXE
4368	PING.EXE
4836	cmd.exe
1336	cmd.exe
5600	PING.EXE
4608	PING.EXE
1952	PING.EXE
5568	PING.EXE
4848	cmd.exe
5064	PING.EXE
2472	cmd.exe
1360	PING.EXE
5008	cmd.exe
4688	PING.EXE
2004	cmd.exe
5828	cmd.exe
4652	PING.EXE
2636	cmd.exe
2380	cmd.exe
5112	PING.EXE
2460	cmd.exe
5136	cmd.exe
5440	cmd.exe
4560	cmd.exe
2280	cmd.exe
3684	cmd.exe
4588	PING.EXE
2852	cmd.exe
828	PING.EXE
4404	PING.EXE
5516	cmd.exe
948	PING.EXE
3456	cmd.exe
1784	cmd.exe
2344	PING.EXE
2080	cmd.exe
1052	cmd.exe
1108	PING.EXE
436	PING.EXE
1932	PING.EXE
4224	PING.EXE
2424	cmd.exe
4856	PING.EXE
1892	cmd.exe
5928	cmd.exe
984	PING.EXE
4280	cmd.exe
4260	cmd.exe
5932	cmd.exe
5028	PING.EXE
4504	PING.EXE

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
756	ipconfig.exe

Runs net.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
2204	PING.EXE
5700	PING.EXE
920	PING.EXE
3724	PING.EXE
4652	PING.EXE
3952	PING.EXE
1180	PING.EXE
3820	PING.EXE
3820	PING.EXE
2804	PING.EXE
1952	PING.EXE
5680	PING.EXE
4632	PING.EXE
1224	PING.EXE
1240	PING.EXE
3992	PING.EXE
5028	PING.EXE
5952	PING.EXE
3120	PING.EXE
1204	PING.EXE
5064	PING.EXE
6004	PING.EXE
2920	PING.EXE
564	PING.EXE
1244	PING.EXE
3100	PING.EXE
5028	PING.EXE
1932	PING.EXE
4132	PING.EXE
4652	PING.EXE
3284	PING.EXE
2892	PING.EXE
5068	PING.EXE
5512	PING.EXE
5020	PING.EXE
3792	PING.EXE
3176	PING.EXE
5516	PING.EXE
1932	PING.EXE
768	PING.EXE
1128	PING.EXE
2152	PING.EXE
1472	PING.EXE
4740	PING.EXE
1916	PING.EXE
2996	PING.EXE
5228	PING.EXE
4140	PING.EXE
1076	PING.EXE
944	PING.EXE
6076	PING.EXE
1932	PING.EXE
5820	PING.EXE
5364	PING.EXE
3824	PING.EXE
2976	PING.EXE
4368	PING.EXE
5064	PING.EXE
5592	PING.EXE
4412	PING.EXE
2988	PING.EXE
4288	PING.EXE
4948	PING.EXE
204	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4348	schtasks.exe
1648	schtasks.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 4928	2092	FortniteCheckerv1.exe	90
PID 2092 wrote to memory of 3164	2092	FortniteCheckerv1.exe	91
PID 2092 wrote to memory of 5920	2092	FortniteCheckerv1.exe	92
PID 5920 wrote to memory of 1648	5920	cmd.exe	93
PID 2092 wrote to memory of 2460	2092	FortniteCheckerv1.exe	94
PID 2092 wrote to memory of 4556	2092	FortniteCheckerv1.exe	95
PID 4556 wrote to memory of 756	4556	cmd.exe	96
PID 4556 wrote to memory of 5996	4556	cmd.exe	97
PID 2092 wrote to memory of 2932	2092	FortniteCheckerv1.exe	99
PID 2932 wrote to memory of 1472	2932	cmd.exe	100
PID 2488 wrote to memory of 4380	2488	svchost.exe	103
PID 2092 wrote to memory of 2592	2092	FortniteCheckerv1.exe	104
PID 2592 wrote to memory of 1420	2592	cmd.exe	105
PID 2488 wrote to memory of 4696	2488	svchost.exe	106
PID 2488 wrote to memory of 3140	2488	svchost.exe	107
PID 3140 wrote to memory of 4348	3140	cmd.exe	108
PID 2092 wrote to memory of 5932	2092	FortniteCheckerv1.exe	109
PID 5932 wrote to memory of 2676	5932	cmd.exe	110
PID 2092 wrote to memory of 2692	2092	FortniteCheckerv1.exe	111
PID 2692 wrote to memory of 2100	2692	cmd.exe	112
PID 2092 wrote to memory of 4160	2092	FortniteCheckerv1.exe	113
PID 4160 wrote to memory of 2080	4160	cmd.exe	114
PID 2092 wrote to memory of 2408	2092	FortniteCheckerv1.exe	115
PID 2408 wrote to memory of 4864	2408	cmd.exe	116
PID 2092 wrote to memory of 3464	2092	FortniteCheckerv1.exe	117
PID 3464 wrote to memory of 4740	3464	cmd.exe	118
PID 2092 wrote to memory of 2852	2092	FortniteCheckerv1.exe	119
PID 2852 wrote to memory of 2892	2852	cmd.exe	120
PID 2092 wrote to memory of 400	2092	FortniteCheckerv1.exe	121
PID 400 wrote to memory of 260	400	cmd.exe	122
PID 2092 wrote to memory of 2020	2092	FortniteCheckerv1.exe	123
PID 2020 wrote to memory of 4828	2020	cmd.exe	124
PID 2092 wrote to memory of 2084	2092	FortniteCheckerv1.exe	125
PID 2084 wrote to memory of 2556	2084	cmd.exe	126
PID 2092 wrote to memory of 4560	2092	FortniteCheckerv1.exe	127
PID 4560 wrote to memory of 3176	4560	cmd.exe	128
PID 2092 wrote to memory of 4984	2092	FortniteCheckerv1.exe	129
PID 4984 wrote to memory of 752	4984	cmd.exe	130
PID 2092 wrote to memory of 2756	2092	FortniteCheckerv1.exe	131
PID 2756 wrote to memory of 4608	2756	cmd.exe	132
PID 2092 wrote to memory of 3808	2092	FortniteCheckerv1.exe	133
PID 3808 wrote to memory of 3752	3808	cmd.exe	134
PID 2092 wrote to memory of 3984	2092	FortniteCheckerv1.exe	135
PID 3984 wrote to memory of 4288	3984	cmd.exe	136
PID 2092 wrote to memory of 4164	2092	FortniteCheckerv1.exe	137
PID 4164 wrote to memory of 1916	4164	cmd.exe	138
PID 2092 wrote to memory of 4824	2092	FortniteCheckerv1.exe	139
PID 4824 wrote to memory of 4788	4824	cmd.exe	140
PID 2092 wrote to memory of 5096	2092	FortniteCheckerv1.exe	141
PID 5096 wrote to memory of 552	5096	cmd.exe	142
PID 2092 wrote to memory of 2424	2092	FortniteCheckerv1.exe	143
PID 2424 wrote to memory of 4856	2424	cmd.exe	144
PID 2092 wrote to memory of 1532	2092	FortniteCheckerv1.exe	145
PID 1532 wrote to memory of 1696	1532	cmd.exe	146
PID 2092 wrote to memory of 5824	2092	FortniteCheckerv1.exe	147
PID 5824 wrote to memory of 1108	5824	cmd.exe	148
PID 2092 wrote to memory of 4836	2092	FortniteCheckerv1.exe	149
PID 4836 wrote to memory of 5364	4836	cmd.exe	150
PID 2092 wrote to memory of 1132	2092	FortniteCheckerv1.exe	151
PID 1132 wrote to memory of 5596	1132	cmd.exe	152
PID 2092 wrote to memory of 4188	2092	FortniteCheckerv1.exe	153
PID 4188 wrote to memory of 5468	4188	cmd.exe	154
PID 2092 wrote to memory of 5644	2092	FortniteCheckerv1.exe	155
PID 5644 wrote to memory of 3880	5644	cmd.exe	156

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\FortniteCheckerv1.exe
"C:\Users\Admin\AppData\Local\Temp\FortniteCheckerv1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mkdir "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices" > nul 2>&1
  2⤵
  PID:4928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\FortniteCheckerv1.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices\svchost.exe" > nul 2>&1
  2⤵
  PID:3164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "SystemServices" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices\svchost.exe" /sc onlogon /ru SYSTEM > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemServices" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices\svchost.exe" /sc onlogon /ru SYSTEM
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mkdir C:\temp
  2⤵
  PID:2460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig | findstr "IPv4" > C:\temp\local_ip.txt
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:756
- - C:\Windows\system32\findstr.exe
    findstr "IPv4"
    3⤵
    PID:5996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.1 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.1
    3⤵
    - Runs ping.exe
    PID:1472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.2 > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.2
    3⤵
    PID:1420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.3 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5932
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.3
    3⤵
    PID:2676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.4 > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.4
    3⤵
    PID:2100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.5 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.5
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.6 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.6
    3⤵
    PID:4864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.7 > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.7
    3⤵
    - Runs ping.exe
    PID:4740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.8 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.8
    3⤵
    - Runs ping.exe
    PID:2892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.9 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.9
    3⤵
    PID:260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.10 > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.10
    3⤵
    PID:4828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.11 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.11
    3⤵
    PID:2556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.12 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.12
    3⤵
    PID:3176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.13 > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.13
    3⤵
    PID:752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.14 > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.14
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.15 > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.15
    3⤵
    PID:3752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.16 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.16
    3⤵
    PID:4288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.17 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.17
    3⤵
    - Runs ping.exe
    PID:1916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.18 > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.18
    3⤵
    PID:4788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.19 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.19
    3⤵
    PID:552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.20 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.20
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.21 > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.21
    3⤵
    PID:1696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.22 > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5824
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.22
    3⤵
    PID:1108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.23 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.23
    3⤵
    - Runs ping.exe
    PID:5364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.24 > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.24
    3⤵
    PID:5596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.25 > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.25
    3⤵
    PID:5468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.26 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5644
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.26
    3⤵
    PID:3880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.27 > nul 2>&1
  2⤵
  PID:3860
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.27
    3⤵
    PID:4580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.28 > nul 2>&1
  2⤵
  PID:788
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.28
    3⤵
    - Runs ping.exe
    PID:3824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.29 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2428
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.29
    3⤵
    PID:1828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.30 > nul 2>&1
  2⤵
  PID:2552
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.30
    3⤵
    PID:2232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.31 > nul 2>&1
  2⤵
  PID:2544
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.31
    3⤵
    PID:1856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.32 > nul 2>&1
  2⤵
  PID:2124
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.32
    3⤵
    PID:1888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.33 > nul 2>&1
  2⤵
  PID:4372
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.33
    3⤵
    PID:2540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.34 > nul 2>&1
  2⤵
  PID:1364
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.34
    3⤵
    PID:1736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.35 > nul 2>&1
  2⤵
  PID:1496
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.35
    3⤵
    PID:3440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.36 > nul 2>&1
  2⤵
  PID:3016
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.36
    3⤵
    PID:3780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.37 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5220
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.37
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.38 > nul 2>&1
  2⤵
  PID:3132
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.38
    3⤵
    - Runs ping.exe
    PID:1240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.39 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4848
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.39
    3⤵
    PID:4508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.40 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3352
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.40
    3⤵
    PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.41 > nul 2>&1
  2⤵
  PID:4944
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.41
    3⤵
    PID:3944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.42 > nul 2>&1
  2⤵
  PID:1208
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.42
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.43 > nul 2>&1
  2⤵
  PID:5876
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.43
    3⤵
    PID:2376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.44 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2812
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.44
    3⤵
    PID:5040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.45 > nul 2>&1
  2⤵
  PID:1540
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.45
    3⤵
    PID:4900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.46 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2472
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.46
    3⤵
    - Runs ping.exe
    PID:4948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.47 > nul 2>&1
  2⤵
  PID:4100
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.47
    3⤵
    PID:5960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.48 > nul 2>&1
  2⤵
  PID:5948
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.48
    3⤵
    - Runs ping.exe
    PID:5592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.49 > nul 2>&1
  2⤵
  PID:5004
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.49
    3⤵
    PID:2960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.50 > nul 2>&1
  2⤵
  PID:3164
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.50
    3⤵
    PID:4408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.51 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2460
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.51
    3⤵
    - Runs ping.exe
    PID:3724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.52 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2280
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.52
    3⤵
    PID:756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.53 > nul 2>&1
  2⤵
  PID:4676
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.53
    3⤵
    PID:2516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.54 > nul 2>&1
  2⤵
  PID:5740
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.54
    3⤵
    PID:2996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.55 > nul 2>&1
  2⤵
  PID:3244
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.55
    3⤵
    PID:5940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.56 > nul 2>&1
  2⤵
  PID:1184
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.56
    3⤵
    - Runs ping.exe
    PID:3820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.57 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3456
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.57
    3⤵
    PID:3296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.58 > nul 2>&1
  2⤵
  PID:3424
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.58
    3⤵
    - Runs ping.exe
    PID:3100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.59 > nul 2>&1
  2⤵
  PID:2784
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.59
    3⤵
    PID:2388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.60 > nul 2>&1
  2⤵
  PID:5476
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.60
    3⤵
    PID:4316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.61 > nul 2>&1
  2⤵
  PID:1652
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.61
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.62 > nul 2>&1
  2⤵
  PID:3892
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.62
    3⤵
    - Runs ping.exe
    PID:2804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.63 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1572
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.63
    3⤵
    - Runs ping.exe
    PID:5028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.64 > nul 2>&1
  2⤵
  PID:5972
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.64
    3⤵
    - Runs ping.exe
    PID:3992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.65 > nul 2>&1
  2⤵
  PID:752
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.65
    3⤵
    PID:1604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.66 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1784
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.66
    3⤵
    - Runs ping.exe
    PID:1932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.67 > nul 2>&1
  2⤵
  PID:2624
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.67
    3⤵
    PID:3444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.68 > nul 2>&1
  2⤵
  PID:6068
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.68
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.69 > nul 2>&1
  2⤵
  PID:4788
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.69
    3⤵
    PID:3080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.70 > nul 2>&1
  2⤵
  PID:4820
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.70
    3⤵
    PID:2992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.71 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2636
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.71
    3⤵
    PID:2252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.72 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6120
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.72
    3⤵
    PID:1268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.73 > nul 2>&1
  2⤵
  PID:5184
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.73
    3⤵
    PID:3840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.74 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2380
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.74
    3⤵
    PID:460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.75 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3652
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.75
    3⤵
    - Runs ping.exe
    PID:2976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.76 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2392
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.76
    3⤵
    PID:828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.77 > nul 2>&1
  2⤵
  PID:5352
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.77
    3⤵
    PID:2232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.78 > nul 2>&1
  2⤵
  PID:1080
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.78
    3⤵
    PID:6024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.79 > nul 2>&1
  2⤵
  PID:1888
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.79
    3⤵
    PID:2876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.80 > nul 2>&1
  2⤵
  PID:3972
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.80
    3⤵
    PID:4444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.81 > nul 2>&1
  2⤵
  PID:6132
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.81
    3⤵
    PID:2768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.82 > nul 2>&1
  2⤵
  PID:1000
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.82
    3⤵
    PID:3780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.83 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4488
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.83
    3⤵
    - Runs ping.exe
    PID:3120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.84 > nul 2>&1
  2⤵
  PID:4684
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.84
    3⤵
    - Runs ping.exe
    PID:1224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.85 > nul 2>&1
  2⤵
  PID:2764
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.85
    3⤵
    - Runs ping.exe
    PID:4412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.86 > nul 2>&1
  2⤵
  PID:1836
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.86
    3⤵
    PID:3944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.87 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3684
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.87
    3⤵
    PID:5064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.88 > nul 2>&1
  2⤵
  PID:2376
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.88
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.89 > nul 2>&1
  2⤵
  PID:3552
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.89
    3⤵
    PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.90 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4516
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.90
    3⤵
    PID:4144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.91 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4920
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.91
    3⤵
    PID:5960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.92 > nul 2>&1
  2⤵
  PID:4764
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.92
    3⤵
    PID:5584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.93 > nul 2>&1
  2⤵
  PID:1312
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.93
    3⤵
    - Runs ping.exe
    PID:5516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.94 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3636
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.94
    3⤵
    PID:4364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.95 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2004
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.95
    3⤵
    - Runs ping.exe
    PID:2204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.96 > nul 2>&1
  2⤵
  PID:2564
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.96
    3⤵
    PID:4420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.97 > nul 2>&1
  2⤵
  PID:2880
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.97
    3⤵
    - Runs ping.exe
    PID:2996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.98 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4696
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.98
    3⤵
    PID:4244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.99 > nul 2>&1
  2⤵
  PID:6044
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.99
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.100 > nul 2>&1
  2⤵
  PID:3296
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.100
    3⤵
    PID:2272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.101 > nul 2>&1
  2⤵
  PID:2924
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.101
    3⤵
    PID:1688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.102 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3328
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.102
    3⤵
    PID:3380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.103 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4316
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.103
    3⤵
    - Runs ping.exe
    PID:5228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.104 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:292
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.104
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.105 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1892
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.105
    3⤵
    PID:2032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.106 > nul 2>&1
  2⤵
  PID:2336
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.106
    3⤵
    PID:3176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.107 > nul 2>&1
  2⤵
  PID:4772
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.107
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.108 > nul 2>&1
  2⤵
  PID:928
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.108
    3⤵
    PID:4588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.109 > nul 2>&1
  2⤵
  PID:1544
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.109
    3⤵
    - Runs ping.exe
    PID:1932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.110 > nul 2>&1
  2⤵
  PID:2332
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.110
    3⤵
    PID:3024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.111 > nul 2>&1
  2⤵
  PID:1412
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.111
    3⤵
    PID:5188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.112 > nul 2>&1
  2⤵
  PID:1968
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.112
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.113 > nul 2>&1
  2⤵
  PID:3000
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.113
    3⤵
    - Runs ping.exe
    PID:1204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.114 > nul 2>&1
  2⤵
  PID:1068
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.114
    3⤵
    PID:5684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.115 > nul 2>&1
  2⤵
  PID:6112
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.115
    3⤵
    PID:6008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.116 > nul 2>&1
  2⤵
  PID:2884
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.116
    3⤵
    PID:1268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.117 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6116
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.117
    3⤵
    PID:4224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.118 > nul 2>&1
  2⤵
  PID:4532
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.118
    3⤵
    - Runs ping.exe
    PID:5068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.119 > nul 2>&1
  2⤵
  PID:5668
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.119
    3⤵
    PID:2976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.120 > nul 2>&1
  2⤵
  PID:4168
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.120
    3⤵
    PID:1732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.121 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:704
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.121
    3⤵
    PID:3812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.122 > nul 2>&1
  2⤵
  PID:4872
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.122
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.123 > nul 2>&1
  2⤵
  PID:5840
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.123
    3⤵
    PID:2732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.124 > nul 2>&1
  2⤵
  PID:3384
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.124
    3⤵
    - Runs ping.exe
    PID:4140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.125 > nul 2>&1
  2⤵
  PID:2768
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.125
    3⤵
    PID:3060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.126 > nul 2>&1
  2⤵
  PID:4600
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.126
    3⤵
    - Runs ping.exe
    PID:4652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.127 > nul 2>&1
  2⤵
  PID:3120
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.127
    3⤵
    PID:1976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.128 > nul 2>&1
  2⤵
  PID:880
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.128
    3⤵
    - Runs ping.exe
    PID:3952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.129 > nul 2>&1
  2⤵
  PID:3488
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.129
    3⤵
    PID:3280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.130 > nul 2>&1
  2⤵
  PID:4228
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.130
    3⤵
    - Runs ping.exe
    PID:5064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.131 > nul 2>&1
  2⤵
  PID:5040
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.131
    3⤵
    PID:5424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.132 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5016
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.132
    3⤵
    PID:3392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.133 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4144
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.133
    3⤵
    PID:5728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.134 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4892
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.134
    3⤵
    PID:5404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.135 > nul 2>&1
  2⤵
  PID:5300
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.135
    3⤵
    PID:1648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.136 > nul 2>&1
  2⤵
  PID:3200
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.136
    3⤵
    PID:6000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.137 > nul 2>&1
  2⤵
  PID:5868
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.137
    3⤵
    - Runs ping.exe
    PID:768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.138 > nul 2>&1
  2⤵
  PID:3048
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.138
    3⤵
    - Runs ping.exe
    PID:5680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.139 > nul 2>&1
  2⤵
  PID:1464
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.139
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.140 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2080
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.140
    3⤵
    PID:3100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.141 > nul 2>&1
  2⤵
  PID:4864
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.141
    3⤵
    - Runs ping.exe
    PID:1180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.142 > nul 2>&1
  2⤵
  PID:5864
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.142
    3⤵
    PID:3380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.143 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:296
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.143
    3⤵
    PID:2628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.144 > nul 2>&1
  2⤵
  PID:1360
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.144
    3⤵
    PID:2804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.145 > nul 2>&1
  2⤵
  PID:5716
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.145
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.146 > nul 2>&1
  2⤵
  PID:5980
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.146
    3⤵
    PID:5844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.147 > nul 2>&1
  2⤵
  PID:3764
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.147
    3⤵
    PID:1604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.148 > nul 2>&1
  2⤵
  PID:2864
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.148
    3⤵
    PID:1932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.149 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2384
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.149
    3⤵
    PID:1624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.150 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1052
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.150
    3⤵
    PID:6052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.151 > nul 2>&1
  2⤵
  PID:832
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.151
    3⤵
    - Runs ping.exe
    PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.152 > nul 2>&1
  2⤵
  PID:1204
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.152
    3⤵
    PID:3076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.153 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5684
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.153
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.154 > nul 2>&1
  2⤵
  PID:1696
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.154
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.155 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4636
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.155
    3⤵
    - Runs ping.exe
    PID:6076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.156 > nul 2>&1
  2⤵
  PID:3804
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.156
    3⤵
    PID:5216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.157 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5068
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.157
    3⤵
    - Runs ping.exe
    PID:5952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.158 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5376
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.158
    3⤵
    PID:6064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.159 > nul 2>&1
  2⤵
  PID:4648
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.159
    3⤵
    PID:5360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.160 > nul 2>&1
  2⤵
  PID:556
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.160
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.161 > nul 2>&1
  2⤵
  PID:5552
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.161
    3⤵
    PID:2788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.162 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3812
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.162
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.163 > nul 2>&1
  2⤵
  PID:2344
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.163
    3⤵
    PID:5164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.164 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2540
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.164
    3⤵
    - Runs ping.exe
    PID:5020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.165 > nul 2>&1
  2⤵
  PID:4444
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.165
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.166 > nul 2>&1
  2⤵
  PID:2684
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.166
    3⤵
    PID:3396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.167 > nul 2>&1
  2⤵
  PID:6020
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.167
    3⤵
    PID:3004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.168 > nul 2>&1
  2⤵
  PID:3884
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.168
    3⤵
    PID:4412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.169 > nul 2>&1
  2⤵
  PID:2500
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.169
    3⤵
    PID:1588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.170 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3300
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.170
    3⤵
    PID:4484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.171 > nul 2>&1
  2⤵
  PID:1920
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.171
    3⤵
    PID:4528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.172 > nul 2>&1
  2⤵
  PID:4688
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.172
    3⤵
    PID:4948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.173 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4440
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.173
    3⤵
    - Runs ping.exe
    PID:1076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.174 > nul 2>&1
  2⤵
  PID:2400
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.174
    3⤵
    PID:1380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.175 > nul 2>&1
  2⤵
  PID:5584
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.175
    3⤵
    PID:5236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.176 > nul 2>&1
  2⤵
  PID:4596
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.176
    3⤵
    PID:4312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.177 > nul 2>&1
  2⤵
  PID:3640
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.177
    3⤵
    PID:2204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.178 > nul 2>&1
  2⤵
  PID:1820
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.178
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.179 > nul 2>&1
  2⤵
  PID:3720
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.179
    3⤵
    PID:1336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.180 > nul 2>&1
  2⤵
  PID:2100
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.180
    3⤵
    PID:1952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.181 > nul 2>&1
  2⤵
  PID:4300
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.181
    3⤵
    PID:3100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.182 > nul 2>&1
  2⤵
  PID:2220
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.182
    3⤵
    PID:1180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.183 > nul 2>&1
  2⤵
  PID:1396
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.183
    3⤵
    - Runs ping.exe
    PID:3792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.184 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5928
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.184
    3⤵
    - Runs ping.exe
    PID:204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.185 > nul 2>&1
  2⤵
  PID:5784
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.185
    3⤵
    PID:352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.186 > nul 2>&1
  2⤵
  PID:5028
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.186
    3⤵
    - Runs ping.exe
    PID:5512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.187 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1632
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.187
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.188 > nul 2>&1
  2⤵
  PID:4804
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.188
    3⤵
    PID:1416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.189 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3172
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.189
    3⤵
    - Runs ping.exe
    PID:4288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.190 > nul 2>&1
  2⤵
  PID:5188
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.190
    3⤵
    PID:3080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.191 > nul 2>&1
  2⤵
  PID:3448
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.191
    3⤵
    PID:4568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.192 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:576
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.192
    3⤵
    PID:4656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.193 > nul 2>&1
  2⤵
  PID:1108
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.193
    3⤵
    - Runs ping.exe
    PID:944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.194 > nul 2>&1
  2⤵
  PID:4152
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.194
    3⤵
    PID:5468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.195 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5828
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.195
    3⤵
    PID:4976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.196 > nul 2>&1
  2⤵
  PID:4612
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.196
    3⤵
    PID:1860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.197 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1100
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.197
    3⤵
    PID:1732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.198 > nul 2>&1
  2⤵
  PID:3472
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.198
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.199 > nul 2>&1
  2⤵
  PID:5272
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.199
    3⤵
    PID:4908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.200 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4868
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.200
    3⤵
    PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.201 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2876
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.201
    3⤵
    - Runs ping.exe
    PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.202 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1216
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.202
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.203 > nul 2>&1
  2⤵
  PID:5356
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.203
    3⤵
    PID:1244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.204 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4320
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.204
    3⤵
    PID:3784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.205 > nul 2>&1
  2⤵
  PID:2828
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.205
    3⤵
    - Runs ping.exe
    PID:1128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.206 > nul 2>&1
  2⤵
  PID:5064
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.206
    3⤵
    PID:1780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.207 > nul 2>&1
  2⤵
  PID:4528
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.207
    3⤵
    - Runs ping.exe
    PID:5700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.208 > nul 2>&1
  2⤵
  PID:1220
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.208
    3⤵
    PID:2308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.209 > nul 2>&1
  2⤵
  PID:5968
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.209
    3⤵
    PID:3760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.210 > nul 2>&1
  2⤵
  PID:1380
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.210
    3⤵
    PID:2224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.211 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4952
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.211
    3⤵
    PID:2036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.212 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6000
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.212
    3⤵
    PID:5528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.213 > nul 2>&1
  2⤵
  PID:436
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.213
    3⤵
    - Runs ping.exe
    PID:3820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.214 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1336
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.214
    3⤵
    PID:948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.215 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3612
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.215
    3⤵
    - Runs ping.exe
    PID:2152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.216 > nul 2>&1
  2⤵
  PID:1592
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.216
    3⤵
    PID:2892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.217 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3040
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.217
    3⤵
    - Runs ping.exe
    PID:4632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.218 > nul 2>&1
  2⤵
  PID:2032
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.218
    3⤵
    PID:2800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.219 > nul 2>&1
  2⤵
  PID:2984
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.219
    3⤵
    - Runs ping.exe
    PID:3176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.220 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5844
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.220
    3⤵
    PID:2556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.221 > nul 2>&1
  2⤵
  PID:3028
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.221
    3⤵
    PID:1384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.222 > nul 2>&1
  2⤵
  PID:3888
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.222
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.223 > nul 2>&1
  2⤵
  PID:5912
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.223
    3⤵
    PID:3728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.224 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3444
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.224
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.225 > nul 2>&1
  2⤵
  PID:3460
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.225
    3⤵
    PID:2252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.226 > nul 2>&1
  2⤵
  PID:2216
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.226
    3⤵
    - Runs ping.exe
    PID:920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.227 > nul 2>&1
  2⤵
  PID:4284
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.227
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.228 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4760
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.228
    3⤵
    PID:5792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.229 > nul 2>&1
  2⤵
  PID:672
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.229
    3⤵
    - Runs ping.exe
    PID:564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.230 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5136
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.230
    3⤵
    PID:3712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.231 > nul 2>&1
  2⤵
  PID:1860
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.231
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net use \\10.127.0.231\c$ /user:Administrator "" > nul 2>&1
  2⤵
  PID:3224
- - C:\Windows\system32\net.exe
    net use \\10.127.0.231\c$ /user:Administrator ""
    3⤵
    PID:5176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.232 > nul 2>&1
  2⤵
  PID:2908
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.232
    3⤵
    PID:3192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.233 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4280
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.233
    3⤵
    PID:2200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.234 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1244
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.234
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.235 > nul 2>&1
  2⤵
  PID:3952
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.235
    3⤵
    - Runs ping.exe
    PID:5820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.236 > nul 2>&1
  2⤵
  PID:3088
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.236
    3⤵
    PID:1756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.237 > nul 2>&1
  2⤵
  PID:4828
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.237
    3⤵
    PID:4904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.238 > nul 2>&1
  2⤵
  PID:4548
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.238
    3⤵
    PID:2096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.239 > nul 2>&1
  2⤵
  PID:2496
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.239
    3⤵
    PID:6056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.240 > nul 2>&1
  2⤵
  PID:3700
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.240
    3⤵
    - Runs ping.exe
    PID:6004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.241 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5008
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.241
    3⤵
    PID:2024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.242 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3924
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.242
    3⤵
    PID:5588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.243 > nul 2>&1
  2⤵
  PID:5676
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.243
    3⤵
    PID:5592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.244 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4260
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.244
    3⤵
    PID:2528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.245 > nul 2>&1
  2⤵
  PID:2820
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.245
    3⤵
    PID:2740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.246 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5516
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.246
    3⤵
    PID:2036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.247 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1232
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.247
    3⤵
    PID:1236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.248 > nul 2>&1
  2⤵
  PID:1472
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.248
    3⤵
    PID:1516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.249 > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3264
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.249
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.250 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5440
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.250
    3⤵
    - Runs ping.exe
    PID:3284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.251 > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2260
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.251
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.252 > nul 2>&1
  2⤵
  PID:3324
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.252
    3⤵
    PID:3100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.253 > nul 2>&1
  2⤵
  PID:1828
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.253
    3⤵
    PID:5812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 -w 100 10.127.0.254 > nul 2>&1
  2⤵
  PID:1180
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 100 10.127.0.254
    3⤵
    PID:2912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir "C:\Windows\*.exe" /b /s > C:\temp\executables_exe.txt
  2⤵
  PID:4632

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices\svchost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices\svchost.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mkdir "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices" > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices\svchost.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices\svchost.exe" > nul 2>&1
  2⤵
  - Executes a file named after a Windows system binary
  PID:4696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "SystemServices" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices\svchost.exe" /sc onlogon /ru SYSTEM > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemServices" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices\svchost.exe" /sc onlogon /ru SYSTEM
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices\svchost.exe
Size 3.7MB
SHA256 810775c20b109dd2e8106d8dc86c8bd44be89191b1d176f318de0536f2aefa31
MD5 e8fb397fd7ffde89bd8e9cb4d9d62501
SHA1 a32c9f976449b62591f302cf3d5badaefbde9c94
SHA512 1cc56c668a669b627a33203634b04dbbdae1d91135fff6a2df95ad58b410c1807a83d21468daab9c389d4cc878bb3614a78e2ab565f42a95ba26b6eb46541207
SSDEEP 49152:4ypFsHuBViNm4lReEIvq6vXhgWVWvAdldddkd1Sd8d7Ydud3dXpUCdfdWdo6l5nG:BT2WlJyvNzsjq
TLSH
T117060893199B0CE6DDD267B4B5CB2239A734FD31CE581A3F9A48C5246C532C4BE2EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

local_ip.txt

Path C:\temp\local_ip.txt
Size 53B
SHA256 d0f5f699c9215e0e5104026e9af9110b3307826b6f58a1d503b79f39e73520f8
MD5 010e5a5273846066d386bb82bff353ba
SHA1 2acd72464cb2315333415e9ed04f264a3568d07c
SHA512 6d18b3020b3f30b40f810ea953ab315a1be48a39a6d63f65b212922135f9e31e009688723af2904f818373c607cac2c5d4a47beee4ffd10b5d26ce5d83d99453
TLSH
T1B39004510D14311D334503300CD4117040C5CCC10445C100FCCD5040D15113C1F00105
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2092-2-0x00007FF7EF4D0000-0x00007FF7EF667000-memory.dmp

Download

memory/2488-3-0x00007FF7607D0000-0x00007FF760967000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads