0095b5db3b02bfa5eae1e43a7de3d333add2e96ec7e976166fc7f2b779b7cf1f

Analysis

max time kernel
900s
max time network
813s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 22:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Spirits - Test/easystart.bat
Size 69B
Sample260802-17ejdashnd
SHA256 0095b5db3b02bfa5eae1e43a7de3d333add2e96ec7e976166fc7f2b779b7cf1f
MD5 903f5e4e5d5998cfe8801c527fc6f7ad
SHA1 b110cbb7489988b97d5fd7fcf4e813cf53bb7915
SHA512 bdeec885bace386f7984dd71516aeed22eaab511bb3ded069b1636dbe88f58134e7da0a98b4e14f447ee0c00fc09d1b4490b2699998531f898e054dc864eea2d
TLSH
T11FA00226104EA9EAE4B71E64547A11913B1941474E08B8D0951F047945C44C4615C861
MD5 SHA1 SHA512 TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3384	cmd.exe

Delays execution with timeout.exe 64 IoCs

defense_evasion

pid	Process
6688	timeout.exe
2252	timeout.exe
3404	timeout.exe
5868	timeout.exe
1784	timeout.exe
6040	timeout.exe
1692	timeout.exe
4560	timeout.exe
6860	timeout.exe
4712	timeout.exe
4132	timeout.exe
2616	timeout.exe
1752	timeout.exe
3176	timeout.exe
5836	timeout.exe
4128	timeout.exe
3068	timeout.exe
6956	timeout.exe
3052	timeout.exe
5368	timeout.exe
6540	timeout.exe
3600	timeout.exe
6912	timeout.exe
5444	timeout.exe
8	timeout.exe
936	timeout.exe
3472	timeout.exe
4788	timeout.exe
1636	timeout.exe
2628	timeout.exe
7032	timeout.exe
3704	timeout.exe
1748	timeout.exe
816	timeout.exe
4064	timeout.exe
700	timeout.exe
6688	timeout.exe
7048	timeout.exe
4692	timeout.exe
4840	timeout.exe
7144	timeout.exe
5416	timeout.exe
2776	timeout.exe
1816	timeout.exe
3524	timeout.exe
7096	timeout.exe
7004	timeout.exe
1696	timeout.exe
6096	timeout.exe
6976	timeout.exe
4140	timeout.exe
3404	timeout.exe
1188	timeout.exe
1840	timeout.exe
6868	timeout.exe
2272	timeout.exe
816	timeout.exe
2332	timeout.exe
3444	timeout.exe
6712	timeout.exe
4852	timeout.exe
5112	timeout.exe
2204	timeout.exe
6044	timeout.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 2032	3384	cmd.exe	92
PID 3384 wrote to memory of 2260	3384	cmd.exe	93
PID 3384 wrote to memory of 2744	3384	cmd.exe	94
PID 3384 wrote to memory of 6656	3384	cmd.exe	95
PID 3384 wrote to memory of 6872	3384	cmd.exe	96
PID 3384 wrote to memory of 4668	3384	cmd.exe	97
PID 3384 wrote to memory of 6308	3384	cmd.exe	99
PID 3384 wrote to memory of 4332	3384	cmd.exe	100
PID 3384 wrote to memory of 1692	3384	cmd.exe	101
PID 3384 wrote to memory of 4212	3384	cmd.exe	102
PID 3384 wrote to memory of 6740	3384	cmd.exe	103
PID 3384 wrote to memory of 3404	3384	cmd.exe	104
PID 3384 wrote to memory of 6976	3384	cmd.exe	105
PID 3384 wrote to memory of 4140	3384	cmd.exe	106
PID 3384 wrote to memory of 1320	3384	cmd.exe	107
PID 3384 wrote to memory of 4904	3384	cmd.exe	108
PID 3384 wrote to memory of 6688	3384	cmd.exe	109
PID 3384 wrote to memory of 3704	3384	cmd.exe	110
PID 3384 wrote to memory of 5280	3384	cmd.exe	111
PID 3384 wrote to memory of 5908	3384	cmd.exe	112
PID 3384 wrote to memory of 4204	3384	cmd.exe	113
PID 3384 wrote to memory of 1188	3384	cmd.exe	114
PID 3384 wrote to memory of 4536	3384	cmd.exe	115
PID 3384 wrote to memory of 3740	3384	cmd.exe	116
PID 3384 wrote to memory of 6340	3384	cmd.exe	117
PID 3384 wrote to memory of 6936	3384	cmd.exe	118
PID 3384 wrote to memory of 1568	3384	cmd.exe	119
PID 3384 wrote to memory of 2684	3384	cmd.exe	120
PID 3384 wrote to memory of 708	3384	cmd.exe	121
PID 3384 wrote to memory of 4316	3384	cmd.exe	122
PID 3384 wrote to memory of 1748	3384	cmd.exe	123
PID 3384 wrote to memory of 4116	3384	cmd.exe	124
PID 3384 wrote to memory of 3176	3384	cmd.exe	125
PID 3384 wrote to memory of 6912	3384	cmd.exe	126
PID 3384 wrote to memory of 1600	3384	cmd.exe	127
PID 3384 wrote to memory of 2080	3384	cmd.exe	128
PID 3384 wrote to memory of 5184	3384	cmd.exe	129
PID 3384 wrote to memory of 7096	3384	cmd.exe	130
PID 3384 wrote to memory of 1116	3384	cmd.exe	131
PID 3384 wrote to memory of 4292	3384	cmd.exe	132
PID 3384 wrote to memory of 1468	3384	cmd.exe	133
PID 3384 wrote to memory of 4840	3384	cmd.exe	134
PID 3384 wrote to memory of 816	3384	cmd.exe	135
PID 3384 wrote to memory of 408	3384	cmd.exe	136
PID 3384 wrote to memory of 5444	3384	cmd.exe	137
PID 3384 wrote to memory of 3132	3384	cmd.exe	138
PID 3384 wrote to memory of 2132	3384	cmd.exe	139
PID 3384 wrote to memory of 7144	3384	cmd.exe	140
PID 3384 wrote to memory of 7160	3384	cmd.exe	141
PID 3384 wrote to memory of 7056	3384	cmd.exe	142
PID 3384 wrote to memory of 4560	3384	cmd.exe	143
PID 3384 wrote to memory of 4160	3384	cmd.exe	144
PID 3384 wrote to memory of 8	3384	cmd.exe	145
PID 3384 wrote to memory of 5372	3384	cmd.exe	146
PID 3384 wrote to memory of 4240	3384	cmd.exe	147
PID 3384 wrote to memory of 3292	3384	cmd.exe	148
PID 3384 wrote to memory of 3456	3384	cmd.exe	149
PID 3384 wrote to memory of 6852	3384	cmd.exe	150
PID 3384 wrote to memory of 5416	3384	cmd.exe	151
PID 3384 wrote to memory of 4852	3384	cmd.exe	152
PID 3384 wrote to memory of 7004	3384	cmd.exe	153
PID 3384 wrote to memory of 4064	3384	cmd.exe	154
PID 3384 wrote to memory of 5340	3384	cmd.exe	161
PID 3384 wrote to memory of 2032	3384	cmd.exe	162

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Spirits - Test\easystart.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:2032
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:2260
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:2744
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6656
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6872
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4668
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6308
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4332
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:1692
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4212
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6740
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:3404
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6976
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:4140
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:1320
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4904
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:6688
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:3704
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:5280
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:5908
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4204
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:1188
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4536
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:3740
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6340
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6936
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:1568
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:2684
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:708
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4316
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:1748
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4116
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:3176
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6912
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:1600
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:2080
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:5184
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:7096
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:1116
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4292
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:1468
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:4840
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:816
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:408
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:5444
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:3132
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:2132
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:7144
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:7160
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:7056
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:4560
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4160
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:8
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:5372
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4240
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:3292
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:3456
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6852
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:5416
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:4852
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:7004
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:4064
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:5340
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:2032
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:3924
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:6860
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4432
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:2252
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4092
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:700
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:936
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:5480
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:4712
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4332
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:2520
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:5748
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:3404
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:5868
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6488
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:3192
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:2660
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4140
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:2272
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:1864
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:52
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:5308
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:1840
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:3472
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:3032
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:1396
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:1696
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:6096
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:6688
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:4132
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:5280
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6876
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:2388
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:6540
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:2616
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6064
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:2908
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:1888
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6936
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:5960
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:3600
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6448
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:1752
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:4788
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4364
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:5848
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:3984
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:1992
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:5112
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:3176
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:6912
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:5628
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:2160
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6048
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:5836
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4744
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4732
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:704
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:816
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4812
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:7048
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:1128
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6980
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6576
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:8
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:1852
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4440
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:3008
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6440
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:2704
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:1636
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4828
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4756
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:7068
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:2776
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6348
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:2628
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:2740
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:2332
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:2204
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:5368
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:4128
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:2920
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6036
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:5632
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6728
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:2092
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:6044
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4032
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:1784
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:4736
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6772
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6452
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:3444
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:3636
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:3068
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:300
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:6976
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6360
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:5328
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:2196
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:6956
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:6712
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:6272
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:5780
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:1816
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:3524
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:3420
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:3052
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:1964
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:7032
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:4692
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:5652
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:6868
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:6040
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2752

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads