081f8a974349d55e9deacced8386c1ee9c9bee50af6b14d152f5b5df825f3619

Analysis

max time kernel
124s
max time network
125s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

INVERT.bat
Size

4KB
MD5

6d406d3c67470f03334e78672648da02
SHA1

b1f93705d5744c96d7785de6dcc79c18ec836328
SHA256

081f8a974349d55e9deacced8386c1ee9c9bee50af6b14d152f5b5df825f3619
SHA512

b5c5f2787efb705c3a1f42b76a2e4b20dfaf4207e2d2e65ad806acaf08610d3a322d4f2c086f5aa2fcea30d81eea1a83e3c7a7e388845d4f41e11636c88768f3
SSDEEP

96:2YkzWe64y+VqJN52piP5izzMxZTCdlA8H8dL2+:2YGVqJNg4P5g+O/ud

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 55 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	Process not Found

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6120	SnippingTool.exe
2600	Process not Found
3096	Process not Found
4644	Process not Found
4172	Process not Found
4028	Process not Found
4100	Process not Found
3236	Process not Found
5528	Process not Found
5124	SnippingTool.exe
860	SnippingTool.exe
3236	Process not Found
4380	Process not Found
5612	Process not Found
3756	Process not Found
4672	Process not Found
5404	Process not Found
5720	Process not Found
2240	Process not Found
3668	Process not Found
5684	Process not Found
2056	Process not Found
5528	Process not Found
5364	Process not Found
2524	Process not Found
4396	Process not Found
952	SnippingTool.exe
5160	SnippingTool.exe
3668	SnippingTool.exe
5924	Process not Found
3300	Process not Found
3748	Process not Found
5748	SnippingTool.exe
5164	Process not Found
3032	Process not Found
948	Process not Found
3452	Process not Found
3756	Process not Found
5160	SnippingTool.exe
928	SnippingTool.exe
3236	SnippingTool.exe
3840	Process not Found
5012	Process not Found
3128	Process not Found
2848	SnippingTool.exe
3884	SnippingTool.exe
4160	Process not Found
5976	Process not Found
3336	SnippingTool.exe
4684	Process not Found
2040	Process not Found
3148	SnippingTool.exe
4016	Process not Found
2344	Process not Found
4924	Process not Found
4848	Process not Found
2572	Process not Found
5652	SnippingTool.exe
3752	Process not Found
2344	Process not Found
1800	SnippingTool.exe
2356	SnippingTool.exe
4176	Process not Found
2664	Process not Found

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
3796	timeout.exe
4824	timeout.exe
4968	timeout.exe
1996	timeout.exe
3428	timeout.exe
4408	timeout.exe
5276	timeout.exe
5352	timeout.exe
4740	Process not Found
4512	timeout.exe
2040	Process not Found
4400	timeout.exe
1056	timeout.exe
2896	timeout.exe
1976	timeout.exe
1452	timeout.exe
3016	timeout.exe
2076	timeout.exe
3772	timeout.exe
1184	Process not Found
2664	Process not Found
3984	timeout.exe
5844	timeout.exe
2104	Process not Found
604	timeout.exe
1900	timeout.exe
756	timeout.exe
2360	timeout.exe
1864	timeout.exe
5616	timeout.exe
3416	timeout.exe
2040	timeout.exe
2432	timeout.exe
3676	timeout.exe
3144	timeout.exe
5184	timeout.exe
5472	timeout.exe
3540	timeout.exe
4560	timeout.exe
4552	timeout.exe
5528	timeout.exe
5088	Process not Found
2008	Process not Found
5688	timeout.exe
3000	timeout.exe
1708	timeout.exe
2568	timeout.exe
4652	timeout.exe
5076	timeout.exe
2844	timeout.exe
2088	timeout.exe
2408	timeout.exe
1504	timeout.exe
2560	timeout.exe
3644	timeout.exe
4504	timeout.exe
4732	timeout.exe
4760	timeout.exe
5568	timeout.exe
3128	timeout.exe
3068	timeout.exe
6096	timeout.exe
3608	timeout.exe
5092	timeout.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5356	mspaint.exe
5668	wordpad.exe
5140	mspaint.exe
5668	wordpad.exe
5584	wordpad.exe
5668	wordpad.exe
5584	wordpad.exe
5140	mspaint.exe
5356	mspaint.exe
2224	mspaint.exe
5584	wordpad.exe
2224	mspaint.exe
2668	WISPTIS.EXE
6032	wordpad.exe
5844	mspaint.exe
6032	wordpad.exe
6032	wordpad.exe
5140	mspaint.exe
2224	mspaint.exe
5140	mspaint.exe
2224	mspaint.exe
5844	mspaint.exe
5356	mspaint.exe
5356	mspaint.exe
1048	wordpad.exe
1048	wordpad.exe
604	mspaint.exe
1048	wordpad.exe
604	mspaint.exe
1064	wordpad.exe
1064	wordpad.exe
5844	mspaint.exe
5844	mspaint.exe
5588	mspaint.exe
1064	wordpad.exe
5588	mspaint.exe
4184	wordpad.exe
5124	SnippingTool.exe
4184	wordpad.exe
1760	mspaint.exe
604	mspaint.exe
604	mspaint.exe
4184	wordpad.exe
1760	mspaint.exe
428	wordpad.exe
428	wordpad.exe
1032	mspaint.exe
5588	mspaint.exe
5588	mspaint.exe
428	wordpad.exe
1032	mspaint.exe
5476	wordpad.exe
5476	wordpad.exe
4864	mspaint.exe
1760	mspaint.exe
1760	mspaint.exe
5476	wordpad.exe
4864	mspaint.exe
3164	wordpad.exe
3164	wordpad.exe
3380	mspaint.exe
1032	mspaint.exe
1032	mspaint.exe
3164	wordpad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 1760	3040	cmd.exe	31
PID 3040 wrote to memory of 1760	3040	cmd.exe	31
PID 3040 wrote to memory of 1760	3040	cmd.exe	31
PID 3040 wrote to memory of 2448	3040	cmd.exe	32
PID 3040 wrote to memory of 2448	3040	cmd.exe	32
PID 3040 wrote to memory of 2448	3040	cmd.exe	32
PID 1760 wrote to memory of 2480	1760	cmd.exe	34
PID 1760 wrote to memory of 2480	1760	cmd.exe	34
PID 1760 wrote to memory of 2480	1760	cmd.exe	34
PID 3040 wrote to memory of 2440	3040	cmd.exe	35
PID 3040 wrote to memory of 2440	3040	cmd.exe	35
PID 3040 wrote to memory of 2440	3040	cmd.exe	35
PID 3040 wrote to memory of 2132	3040	cmd.exe	36
PID 3040 wrote to memory of 2132	3040	cmd.exe	36
PID 3040 wrote to memory of 2132	3040	cmd.exe	36
PID 3040 wrote to memory of 2808	3040	cmd.exe	38
PID 3040 wrote to memory of 2808	3040	cmd.exe	38
PID 3040 wrote to memory of 2808	3040	cmd.exe	38
PID 3040 wrote to memory of 2880	3040	cmd.exe	39
PID 3040 wrote to memory of 2880	3040	cmd.exe	39
PID 3040 wrote to memory of 2880	3040	cmd.exe	39
PID 2440 wrote to memory of 2900	2440	cmd.exe	41
PID 2440 wrote to memory of 2900	2440	cmd.exe	41
PID 2440 wrote to memory of 2900	2440	cmd.exe	41
PID 3040 wrote to memory of 3064	3040	cmd.exe	42
PID 3040 wrote to memory of 3064	3040	cmd.exe	42
PID 3040 wrote to memory of 3064	3040	cmd.exe	42
PID 3040 wrote to memory of 2804	3040	cmd.exe	43
PID 3040 wrote to memory of 2804	3040	cmd.exe	43
PID 3040 wrote to memory of 2804	3040	cmd.exe	43
PID 3040 wrote to memory of 3052	3040	cmd.exe	44
PID 3040 wrote to memory of 3052	3040	cmd.exe	44
PID 3040 wrote to memory of 3052	3040	cmd.exe	44
PID 3040 wrote to memory of 2656	3040	cmd.exe	45
PID 3040 wrote to memory of 2656	3040	cmd.exe	45
PID 3040 wrote to memory of 2656	3040	cmd.exe	45
PID 3040 wrote to memory of 2768	3040	cmd.exe	47
PID 3040 wrote to memory of 2768	3040	cmd.exe	47
PID 3040 wrote to memory of 2768	3040	cmd.exe	47
PID 2808 wrote to memory of 2432	2808	cmd.exe	46
PID 2808 wrote to memory of 2432	2808	cmd.exe	46
PID 2808 wrote to memory of 2432	2808	cmd.exe	46
PID 3040 wrote to memory of 2868	3040	cmd.exe	48
PID 3040 wrote to memory of 2868	3040	cmd.exe	48
PID 3040 wrote to memory of 2868	3040	cmd.exe	48
PID 3040 wrote to memory of 3024	3040	cmd.exe	52
PID 3040 wrote to memory of 3024	3040	cmd.exe	52
PID 3040 wrote to memory of 3024	3040	cmd.exe	52
PID 3040 wrote to memory of 3016	3040	cmd.exe	53
PID 3040 wrote to memory of 3016	3040	cmd.exe	53
PID 3040 wrote to memory of 3016	3040	cmd.exe	53
PID 3064 wrote to memory of 1856	3064	cmd.exe	55
PID 3064 wrote to memory of 1856	3064	cmd.exe	55
PID 3064 wrote to memory of 1856	3064	cmd.exe	55
PID 3040 wrote to memory of 2696	3040	cmd.exe	56
PID 3040 wrote to memory of 2696	3040	cmd.exe	56
PID 3040 wrote to memory of 2696	3040	cmd.exe	56
PID 3040 wrote to memory of 2488	3040	cmd.exe	57
PID 3040 wrote to memory of 2488	3040	cmd.exe	57
PID 3040 wrote to memory of 2488	3040	cmd.exe	57
PID 2768 wrote to memory of 2664	2768	cmd.exe	59
PID 2768 wrote to memory of 2664	2768	cmd.exe	59
PID 2768 wrote to memory of 2664	2768	cmd.exe	59
PID 3040 wrote to memory of 2680	3040	cmd.exe	60

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\INVERT.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2480
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2448
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2900
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2132
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:2432
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2880
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1856
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2804
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3052
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2724
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2656
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2664
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2868
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3024
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2824
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:3016
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2696
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2632
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2488
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2680
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1748
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2708
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2212
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1524
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2700
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2216
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2584
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1032
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1780
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:3000
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2380
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:392
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2040
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1676
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2588
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1912
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2580
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1620
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1572
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2016
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2236
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:604
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1800
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1384
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2428
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:584
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1092
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2416
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:756
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2176
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:952
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:2076
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2408
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2564
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2084
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1156
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:784
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2300
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1944
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1300
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1732
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2436
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1060
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:948
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2356
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:1996
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1124
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:840
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:540
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1904
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1036
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2484
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2604
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:296
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2244
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2096
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2088
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1604
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1796
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:372
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2252
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1200
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2520
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2120
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:744
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1008
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:1708
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2264
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1744
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2528
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1336
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2524
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:1900
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2532
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1684
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:1504
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1568
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1712
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2804
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:860
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2508
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3004
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2152
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2944
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:756
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2780
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2892
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2168
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2880
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1160
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2368
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2816
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1072
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2264
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2700
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1032
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1456
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2544
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2908
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1320
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:2568
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2104
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1568
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:584
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2084
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2580
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2468
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:112
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:932
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:692
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2604
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1904
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:932
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2540
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2136
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1628
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2532
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2652
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1484
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2932
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3112
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2136
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2348
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3148
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:2560
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2148
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3188
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1904
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2152
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3228
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1484
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3080
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3220
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3088
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3120
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3280
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3128
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3160
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3244
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3168
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3204
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3320
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3212
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3256
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3364
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3264
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3296
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3404
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3304
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3336
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3512
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3344
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3376
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3472
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3384
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3416
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3556
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:3428
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3444
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:3608
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3464
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3484
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3776
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3492
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3524
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3700
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:3540
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3564
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3808
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3572
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3592
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3852
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3600
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3636
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3800
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:3644
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3668
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3860
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:3676
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3708
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4064
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3716
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3724
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4056
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3732
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3760
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:3144
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3768
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3816
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4048
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3824
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3868
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3092
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3876
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3920
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3396
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3928
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3952
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3504
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3960
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3984
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3600
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3992
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4016
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3720
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4024
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4072
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:3772
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4080
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3128
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3992
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3172
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3268
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4004
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3316
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3384
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3540
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3428
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3536
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4080
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3540
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3648
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4132
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3680
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3748
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4188
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3828
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3876
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4176
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3944
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4084
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4232
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4080
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3316
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4264
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3440
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3824
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4280
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3880
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3428
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4348
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3944
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4112
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:4408
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4124
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4148
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4432
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4156
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4200
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4464
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4212
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4240
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:4504
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4248
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4288
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4552
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4296
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4320
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4560
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4328
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4360
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4616
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4368
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4392
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4636
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4400
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4440
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4676
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4448
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4480
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4700
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4488
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4520
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4708
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4528
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4568
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4760
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4576
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4600
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4868
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4608
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4644
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4884
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:4652
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4684
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5012
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4692
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4716
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5024
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:4732
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4772
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5032
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4780
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4800
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:5076
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4808
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4840
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5116
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4848
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4892
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4216
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4900
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4920
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4332
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4928
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4956
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4528
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4964
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4984
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4540
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4992
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5040
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4696
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5048
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5084
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4828
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:5092
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3960
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4912
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4128
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4212
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4172
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4252
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4384
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4492
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4368
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4448
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4928
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4492
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4628
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5128
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4656
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4792
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5164
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4780
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4932
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5236
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4928
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4992
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5244
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5048
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4248
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:5276
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:4400
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4652
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5296
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4852
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5048
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5332
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4420
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5136
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5376
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5144
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5176
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5408
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:5184
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5208
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5440
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5224
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5256
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5488
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5268
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5304
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5552
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5312
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5344
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5632
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5352
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5384
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5704
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5392
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5424
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5716
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5432
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5460
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5752
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:5472
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5496
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5796
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5504
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5532
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5804
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5540
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5576
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5876
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5584
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5608
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5952
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:5616
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5648
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5992
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5656
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5680
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:6000
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5688
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5728
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:6028
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5736
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5764
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:6048
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5772
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5816
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:6084
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5824
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5848
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:6128
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5856
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5888
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5184
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5896
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5920
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5228
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5928
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5960
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5392
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5968
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:6008
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5620
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:6016
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:6056
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5776
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:6064
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:6096
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5912
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:6104
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:6136
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:6020
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4812
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5196
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2744
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5288
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5312
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2040
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:5352
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5432
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1572
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5472
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5540
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2724
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5588
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5700
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:264
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:5688
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5828
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:552
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5868
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5928
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1748
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5972
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:6116
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3012
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:6104
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5324
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2876
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5396
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2480
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5472
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:2844
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1524
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2884
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1760
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2820
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2680
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:1056
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2432
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5868
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2900
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2384
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1768
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2836
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2404
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:952
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2600
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2812
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2832
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:2896
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2216
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1708
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:108
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1612
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2420
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2400
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2768
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1412
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2860
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5660
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2416
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5736
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5972
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2564
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2364
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1508
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2176
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2240
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1060
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1048
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2936
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1096
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2484
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2008
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2308
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2656
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1624
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1596
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:540
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:844
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2904
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2332
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1520
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1804
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:2088
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1884
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:296
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2032
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2100
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2368
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1548
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1504
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2508
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2004
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2132
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1652
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2900
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2500
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2336
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2764
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2452
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:928
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:108
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3016
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1008
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3512
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2916
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2412
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3372
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:1976
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1592
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3188
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:2408
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:372
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2264
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2892
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:460
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2912
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:2360
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2268
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3560
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:912
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2628
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3324
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2968
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2600
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2084
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2828
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3228
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:924
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3340
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3220
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2568
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3148
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2580
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3160
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3280
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3352
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3100
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2700
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2152
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3380
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2544
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3408
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3120
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1848
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1488
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:860
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3288
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3420
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3444
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:948
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2096
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3360
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3176
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3460
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5860
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1400
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:584
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3088
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2716
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2732
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4060
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3400
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2780
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3896
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3204
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3452
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3504
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:1864
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1464
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3740
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2852
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2364
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3804
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2068
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1716
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3764
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2008
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4064
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:3796
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3808
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3860
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:844
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3956
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3912
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1884
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3776
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3708
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2492
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3752
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3888
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2304
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3484
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3852
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4076
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3144
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3976
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4088
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3588
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3664
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4020
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3528
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3760
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1484
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3844
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3532
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4264
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:936
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1128
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3836
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1504
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1164
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3756
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:1452
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2612
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3648
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3768
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3356
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3172
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3104
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4044
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4000
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3824
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4080
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:912
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4036
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2424
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2276
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4188
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3180
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4428
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3432
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3344
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4320
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4012
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3620
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4472
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:3128
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3268
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4524
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3304
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3736
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4544
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2324
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2552
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4444
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2664
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3340
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4256
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:4560
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4712
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4432
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4508
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4704
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4360
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4888
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4272
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4572
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4620
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4348
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2776
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4584
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4140
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4168
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4468
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4556
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5012
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:4552
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4664
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2016
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:4512
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4596
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4820
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4380
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4316
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1356
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4184
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4356
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5116
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4148
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3076
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4984
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1904
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3124
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4920
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3476
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3176
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5056
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:3068
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3400
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4800
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3292
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4900
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:4824
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3412
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4156
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4160
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4540
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4332
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3712
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4224
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4896
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3980
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4960
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4916
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3704
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5024
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4940
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4308
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4804
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4720
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:4968
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4796
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4856
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5376
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4716
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2852
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4656
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3004
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3808
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4368
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3396
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3968
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5200
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3484
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5332
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4300
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4944
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5244
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3528
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5280
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5128
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4028
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5168
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5064
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3716
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4252
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4836
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5720
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5172
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4576
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5460
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4448
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4628
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5708
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4728
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5008
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5552
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4864
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3696
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5492
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2528
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2916
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3432
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1452
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3824
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3604
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4136
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5756
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5600
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5636
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5796
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5412
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5372
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5416
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5368
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5528
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5572
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2324
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5560
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5468
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:4760
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5328
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5252
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5816
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5320
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5340
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5852
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5176
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3240
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5744
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:3984
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4324
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5792
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4560
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3364
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3428
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4620
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5904
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2880
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4584
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5644
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5072
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5624
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5992
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5184
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5652
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:6052
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5772
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5648
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5580
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5228
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:5844
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5832
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5924
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5840
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4868
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:3004
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1560
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4632
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:2040
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4184
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:1468
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:6024
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:3416
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5896
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4796
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:6100
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:6020
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:2876
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  - Delays execution with timeout.exe
  PID:6096
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:6140
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:516
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5960
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:6092
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5188
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:6080
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:6124
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:1572
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5888
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5040
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:5568
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4528
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4808
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5276
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5024
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:4816
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4732
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4052
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:5452
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:4036
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5240
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:3484
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    PID:5176
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1640
- C:\Windows\system32\cmd.exe
  cmd /c "echo YOU HAVE BEEN FUCKED BY FTSyxcal's RAT & timeout /t 10 & exit"
  2⤵
  PID:2576
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:5528
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1620
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:5980
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:5828
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:5356
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5668
- C:\Windows\system32\SnippingTool.exe
  snippingtool
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5124
- - C:\Windows\SYSTEM32\WISPTIS.EXE
    "C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2668
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:4944
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:5296
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:4124
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:5140
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5584
- C:\Windows\system32\SnippingTool.exe
  snippingtool
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:952
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:772
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:2632
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:2784
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2224
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:6032
- C:\Windows\system32\SnippingTool.exe
  snippingtool
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5652
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5724
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:5604
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:540
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:5844
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1048
- C:\Windows\system32\SnippingTool.exe
  snippingtool
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5160
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2056
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:1360
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:2220
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:604
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1064
- C:\Windows\system32\SnippingTool.exe
  snippingtool
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1800
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2416
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:1300
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:2496
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:5588
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4184
- C:\Windows\system32\SnippingTool.exe
  snippingtool
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6120
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3412
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:5892
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:6136
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:1760
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:428
- C:\Windows\system32\SnippingTool.exe
  snippingtool
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:928
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:840
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:5984
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:1652
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:1032
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5476
- C:\Windows\system32\SnippingTool.exe
  snippingtool
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5748
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5928
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:5856
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:4944
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:4864
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3164
- C:\Windows\system32\SnippingTool.exe
  snippingtool
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3336
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2136
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:2264
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:2652
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:3380
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  PID:3228
- C:\Windows\system32\SnippingTool.exe
  snippingtool
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2356
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3112
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:3516
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:2180
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  PID:1684
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  PID:2628
- C:\Windows\system32\SnippingTool.exe
  snippingtool
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2848
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2836
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:1852
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:1888
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  PID:2212
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  PID:3488
- C:\Windows\system32\SnippingTool.exe
  snippingtool
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:860
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:5860
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:3548
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:3200
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  PID:3092
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  PID:2780
- C:\Windows\system32\SnippingTool.exe
  snippingtool
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3236
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2104
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:3208
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:508
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  PID:3272
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  PID:5972
- C:\Windows\system32\SnippingTool.exe
  snippingtool
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5160
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2056
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:3920
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:3700
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  PID:3168
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  PID:3684
- C:\Windows\system32\SnippingTool.exe
  snippingtool
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3884
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:3840
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:3912
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:1688
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  PID:3800
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  PID:3856
- C:\Windows\system32\SnippingTool.exe
  snippingtool
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3668
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:2944
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:3864
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:3820
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  PID:3392
- C:\Program Files\Windows NT\Accessories\wordpad.exe
  "C:\Program Files\Windows NT\Accessories\wordpad.exe"
  2⤵
  PID:5688
- C:\Windows\system32\SnippingTool.exe
  snippingtool
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3148
- C:\Windows\system32\timeout.exe
  timeout /t 0.1
  2⤵
  PID:1560
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:3172
- C:\Windows\system32\calc.exe
  calc
  2⤵
  PID:3648
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  PID:4180

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-11932820211695383576-18538312601160147822350639240679737956-1900462497-393689189"
1⤵
PID:2380

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1117515511-2001579447-1619165622-588696107460222025-1124003398-12962268532033208600"
1⤵
PID:2076

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1501053418352004219-897583006-81122883533647362918149118651588576138-2077569428"
1⤵
PID:1732

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-11762511242013259250-1303646648-1265085529-282245711-1227187876-1343330183463299265"
1⤵
PID:2016

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-830621675-12103827705893284-13097323313230849631418856122-8947197281909329243"
1⤵
PID:2544

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-171928964857352773861820523102928462115201124922032752866-1380119050-1635393239"
1⤵
PID:3304

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1671037433-1150972423292719751110751942612479744302076076-973088590-318572636"
1⤵
PID:3572

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1859137136787603085540595874-1523843525-1356631722560138892817308651-734337597"
1⤵
PID:3928

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-17810914791047332294-16471259591533009802-1678349270-1607849921-1498915560-1389301300"
1⤵
PID:3880

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1721281906-335504654198434897591099410-459546511-9550390121566473752-526084239"
1⤵
PID:4964

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1267557520151223926142289942416945981261641525887233691361-704932973-1164533358"
1⤵
PID:4368

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-550288916-21763132315880778423246573921644605624-154036731-1167759128-982352149"
1⤵
PID:4780

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1704170778257553710-1875971329-287025686-982686521-992483192-1040462887-17693819"
1⤵
PID:4420

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1763273710781577535-174635178523379874-1542322050-929807222-1880238256-773134038"
1⤵
PID:5268

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2145454085-911989160-10020644801488105987665277825-1610170762-457370115998558033"
1⤵
PID:5616

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1285101460427464365984848646-1748459856-2013206795-10440006063849218631598443316"
1⤵
PID:5856

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-14263786691620350528-237092562-461228642-731395-650591503630483687-624544111"
1⤵
PID:6016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/604-645-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/604-72-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/936-702-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/1032-668-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/1032-114-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/1076-510-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/1096-732-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/1456-920-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/1684-713-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/1684-156-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/1696-672-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/1760-100-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/1760-656-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/2204-747-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/2204-804-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/2212-160-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/2212-728-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/2224-624-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/2224-34-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/2240-552-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/2408-300-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/2408-850-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3008-646-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3024-496-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3092-179-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3092-743-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3156-568-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3168-212-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3168-762-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3272-198-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3272-758-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3356-263-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3356-803-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3380-698-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3380-142-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3392-235-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3392-788-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3456-524-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3484-717-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3724-657-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3788-625-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3800-774-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3800-221-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/3808-580-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/4180-244-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/4180-789-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/4256-286-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/4256-833-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/4268-819-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/4268-272-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/4308-919-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/4308-359-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/4400-314-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/4400-874-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/4524-538-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/4540-763-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/4540-818-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/4556-687-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/4652-417-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/4808-454-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/4828-370-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/4864-128-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/4864-683-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/4912-328-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/4912-888-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/5024-902-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/5024-342-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/5140-609-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/5140-30-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/5184-431-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/5356-608-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/5356-29-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/5428-398-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/5576-440-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/5588-652-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/5588-86-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/5724-482-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/5744-386-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/5844-48-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/5844-636-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/5848-594-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/6052-610-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download
memory/6060-472-0x000007FEF6E10000-0x000007FEF6E5C000-memory.dmp

Filesize
304KB

Download