That could be anything from windows updates to malware, excluding any 3rd party apps those PC's had installed, av scans, etc etc etc.
Also disk usage has ZIP to do with mining.
Full of s&#t, none of them. I made my investigation on multiple PC's with the following results:
- It applies equally to the fresh installation, with no third-party apps/drivers installed.
- It has nothing to do with Windows updating itself, as Internet connection is cut. It supposed to be disabled as a principle I can't work on auto updating Windows.
- All suspected services like Windows Update service, Defender, BITS, indexing service, etc... are disabled
- The background prosess responsible for spurious disk activity is carefully hidden from the Task Manager. Disk activity stops immediately once you start using computer
- The only indication for background bot-net activity is a hard drive LED and a seek noise from the device. This ia the only things Microsoft cannot hide from the users, as it is a hardware feature.
A hardware SATA sniffer device is needed to find out what files are accessed, maybe someone can borrow one to me.
Crypto-mining works on large data structures, it evidently doesn't fit in 4GB of RAM, it is why constant swapping to the hard drive occurs. It may fit in 8GB or higher configurations then you will no notice of hard drive trashing syndrome - user feedback is required. Interesting that I also didn't notice hard drive trashing on PC's with 2GB RAM or lower. Is it a reason why 2GB RAM is not supported anymore???
Finally, it is relevant to this thread, as we have bot-nets active on our PC's since introduction of Windows 10.