zgrat | 872a2f4decf76a5c8cf44a9b017a780847d8b3c50571433232e398ab0931c638

Analysis

max time kernel
150s
max time network
152s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
07-05-2024 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nursultan 1.16.5 Crack.exe
Size

8.7MB
MD5

57ec49d438753f3bdfec6a616258b370
SHA1

a34f757f5f2bd4763f04206c0d0cd32ab4491117
SHA256

872a2f4decf76a5c8cf44a9b017a780847d8b3c50571433232e398ab0931c638
SHA512

88bdae1b6a45efa83c4a9ff28a4549c33db28ba2bb1d1911d028090e9dc3831ef57f6577388844a4cfccc60dbca70315a7f9d7311f6638bcf00da97110e1c64a
SSDEEP

196608:ITAJDpNk+Rl4/Xi/yRvyCyKuhBfldGdrmVLaY1rHgu:oAlzJ7yRvyCx+xpgu

Score

10^/10

zgrat rat upx

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral1/files/0x000800000001ac14-26.dat	family_zgrat_v1
behavioral1/memory/5924-213-0x0000000000CE0000-0x000000000106E000-memory.dmp	family_zgrat_v1
behavioral1/files/0x000a00000001ac1a-273.dat	family_zgrat_v1

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4248	4804	schtasks.exe	446
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4336	4804	schtasks.exe	446
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6868	4804	schtasks.exe	446
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7680	4804	schtasks.exe	446
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7828	4804	schtasks.exe	446
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8004	4804	schtasks.exe	446
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4384	4804	schtasks.exe	446
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7192	4804	schtasks.exe	446
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6272	4804	schtasks.exe	446
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	4804	schtasks.exe	446
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7900	4804	schtasks.exe	446
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7960	4804	schtasks.exe	446
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7740	4804	schtasks.exe	446
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8080	4804	schtasks.exe	446
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	4804	schtasks.exe	446
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7584	4804	schtasks.exe	446
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7792	4804	schtasks.exe	446
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7260	4804	schtasks.exe	446

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Executes dropped EXE 20 IoCs

pid	Process
4852	Nursultan 1.16.5 Crack.exe
828	leetcrack.exe
4376	Nursultan 1.16.5 Crack.exe
196	leetcrack.exe
4560	Nursultan 1.16.5 Crack.exe
4928	leetcrack.exe
4580	3b73a6fa2092a350d795.exe
1352	3b73a6fa2092a350d795.exe
2288	portmonitor.exe
2612	portmonitor.exe
1696	Nursultan 1.16.5 Crack.exe
3408	3b73a6fa2092a350d795.exe
1376	portmonitor.exe
4384	leetcrack.exe
3008	Nursultan 1.16.5 Crack.exe
504	3b73a6fa2092a350d795.exe
4204	portmonitor.exe
1272	leetcrack.exe
436	Nursultan 1.16.5 Crack.exe
368	leetcrack.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000800000001ac11-11.dat	upx
behavioral1/memory/4580-27-0x00007FF7CB880000-0x00007FF7CC4AA000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
7828	schtasks.exe
7740	schtasks.exe
7260	schtasks.exe
4248	schtasks.exe
4384	schtasks.exe
6272	schtasks.exe
7900	schtasks.exe
8080	schtasks.exe
7680	schtasks.exe
2612	schtasks.exe
7960	schtasks.exe
7792	schtasks.exe
4336	schtasks.exe
6868	schtasks.exe
8004	schtasks.exe
7192	schtasks.exe
2736	schtasks.exe
7584	schtasks.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	portmonitor.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	portmonitor.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	portmonitor.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4140	PING.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 4852	1900	Nursultan 1.16.5 Crack.exe	74
PID 1900 wrote to memory of 4852	1900	Nursultan 1.16.5 Crack.exe	74
PID 1900 wrote to memory of 4852	1900	Nursultan 1.16.5 Crack.exe	74
PID 1900 wrote to memory of 828	1900	Nursultan 1.16.5 Crack.exe	75
PID 1900 wrote to memory of 828	1900	Nursultan 1.16.5 Crack.exe	75
PID 1900 wrote to memory of 828	1900	Nursultan 1.16.5 Crack.exe	75
PID 4852 wrote to memory of 4376	4852	Nursultan 1.16.5 Crack.exe	76
PID 4852 wrote to memory of 4376	4852	Nursultan 1.16.5 Crack.exe	76
PID 4852 wrote to memory of 4376	4852	Nursultan 1.16.5 Crack.exe	76
PID 4852 wrote to memory of 196	4852	Nursultan 1.16.5 Crack.exe	77
PID 4852 wrote to memory of 196	4852	Nursultan 1.16.5 Crack.exe	77
PID 4852 wrote to memory of 196	4852	Nursultan 1.16.5 Crack.exe	77
PID 4376 wrote to memory of 4560	4376	Nursultan 1.16.5 Crack.exe	78
PID 4376 wrote to memory of 4560	4376	Nursultan 1.16.5 Crack.exe	78
PID 4376 wrote to memory of 4560	4376	Nursultan 1.16.5 Crack.exe	78
PID 4376 wrote to memory of 4928	4376	Nursultan 1.16.5 Crack.exe	263
PID 4376 wrote to memory of 4928	4376	Nursultan 1.16.5 Crack.exe	263
PID 4376 wrote to memory of 4928	4376	Nursultan 1.16.5 Crack.exe	263
PID 828 wrote to memory of 4580	828	leetcrack.exe	79
PID 828 wrote to memory of 4580	828	leetcrack.exe	79
PID 196 wrote to memory of 1352	196	leetcrack.exe	81
PID 196 wrote to memory of 1352	196	leetcrack.exe	81
PID 828 wrote to memory of 2288	828	leetcrack.exe	82
PID 828 wrote to memory of 2288	828	leetcrack.exe	82
PID 828 wrote to memory of 2288	828	leetcrack.exe	82
PID 196 wrote to memory of 2612	196	leetcrack.exe	501
PID 196 wrote to memory of 2612	196	leetcrack.exe	501
PID 196 wrote to memory of 2612	196	leetcrack.exe	501
PID 4560 wrote to memory of 1696	4560	Nursultan 1.16.5 Crack.exe	84
PID 4560 wrote to memory of 1696	4560	Nursultan 1.16.5 Crack.exe	84
PID 4560 wrote to memory of 1696	4560	Nursultan 1.16.5 Crack.exe	84
PID 4928 wrote to memory of 3408	4928	leetcrack.exe	350
PID 4928 wrote to memory of 3408	4928	leetcrack.exe	350
PID 4928 wrote to memory of 1376	4928	leetcrack.exe	86
PID 4928 wrote to memory of 1376	4928	leetcrack.exe	86
PID 4928 wrote to memory of 1376	4928	leetcrack.exe	86
PID 4560 wrote to memory of 4384	4560	Nursultan 1.16.5 Crack.exe	488
PID 4560 wrote to memory of 4384	4560	Nursultan 1.16.5 Crack.exe	488
PID 4560 wrote to memory of 4384	4560	Nursultan 1.16.5 Crack.exe	488
PID 1696 wrote to memory of 3008	1696	Nursultan 1.16.5 Crack.exe	537
PID 1696 wrote to memory of 3008	1696	Nursultan 1.16.5 Crack.exe	537
PID 1696 wrote to memory of 3008	1696	Nursultan 1.16.5 Crack.exe	537
PID 4384 wrote to memory of 504	4384	leetcrack.exe	344
PID 4384 wrote to memory of 504	4384	leetcrack.exe	344
PID 2288 wrote to memory of 4804	2288	portmonitor.exe	446
PID 2288 wrote to memory of 4804	2288	portmonitor.exe	446
PID 2288 wrote to memory of 4804	2288	portmonitor.exe	446
PID 4384 wrote to memory of 4204	4384	leetcrack.exe	307
PID 4384 wrote to memory of 4204	4384	leetcrack.exe	307
PID 4384 wrote to memory of 4204	4384	leetcrack.exe	307
PID 1696 wrote to memory of 1272	1696	Nursultan 1.16.5 Crack.exe	92
PID 1696 wrote to memory of 1272	1696	Nursultan 1.16.5 Crack.exe	92
PID 1696 wrote to memory of 1272	1696	Nursultan 1.16.5 Crack.exe	92
PID 3008 wrote to memory of 436	3008	Nursultan 1.16.5 Crack.exe	93
PID 3008 wrote to memory of 436	3008	Nursultan 1.16.5 Crack.exe	93
PID 3008 wrote to memory of 436	3008	Nursultan 1.16.5 Crack.exe	93
PID 2612 wrote to memory of 3592	2612	portmonitor.exe	1091
PID 2612 wrote to memory of 3592	2612	portmonitor.exe	1091
PID 2612 wrote to memory of 3592	2612	portmonitor.exe	1091
PID 3008 wrote to memory of 368	3008	Nursultan 1.16.5 Crack.exe	95
PID 3008 wrote to memory of 368	3008	Nursultan 1.16.5 Crack.exe	95
PID 3008 wrote to memory of 368	3008	Nursultan 1.16.5 Crack.exe	95
PID 4204 wrote to memory of 3692	4204	portmonitor.exe	2277
PID 4204 wrote to memory of 3692	4204	portmonitor.exe	2277

C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
  "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
    "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
      "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        7⤵
        Executes dropped EXE
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        8⤵
        
        PID:648
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        9⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        10⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        11⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        12⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        13⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        14⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        15⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        16⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        17⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        18⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        19⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        20⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        21⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        22⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        23⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        24⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        25⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        26⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        27⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        28⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        29⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        30⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        31⤵
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        32⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        33⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        34⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        35⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        36⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        37⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        38⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        39⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        40⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        41⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        42⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        43⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        44⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        45⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        46⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        47⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        48⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        49⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        50⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        51⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        52⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        53⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        54⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        55⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        56⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        57⤵
        
        PID:504
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        58⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        59⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        60⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        61⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        62⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        63⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        64⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        65⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        66⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        67⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        68⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        69⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        70⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        71⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        72⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        73⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        74⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        75⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        76⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        77⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        78⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        79⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        80⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        81⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        82⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        83⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        84⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        85⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        86⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        87⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        88⤵
        
        PID:664
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        89⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        90⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        91⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        92⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        93⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        94⤵
        
        PID:9016
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        95⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        96⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        97⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        98⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        99⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        100⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        101⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        102⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        103⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        104⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        105⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        106⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        107⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        108⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        109⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        110⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        111⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        112⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        113⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        114⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        115⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        116⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        117⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        118⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        119⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        120⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        121⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        122⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        123⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        124⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        125⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        126⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        127⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        128⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        129⤵
        
        PID:9100
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        130⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        131⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        132⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        133⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        134⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        135⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        136⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        137⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        138⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        139⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        140⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        141⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        142⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        143⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        144⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        145⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        146⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        147⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        148⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        149⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        150⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        151⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        152⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        153⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        154⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        155⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        156⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        157⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        158⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        159⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        160⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        161⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        162⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        163⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        164⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
        165⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        165⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        164⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        163⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        164⤵
        
        PID:9072
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        164⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        165⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        162⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        163⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        163⤵
        
        PID:208
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        164⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        161⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        162⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        162⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        163⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        160⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        161⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        161⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        162⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        159⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        160⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        160⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        161⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        158⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        159⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        159⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        160⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        157⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        158⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        158⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        159⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        156⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        157⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        157⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        158⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        155⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        156⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        156⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        157⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        154⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        155⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        155⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        156⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        153⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        154⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        154⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        155⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        152⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        153⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        153⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        154⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        151⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        152⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        152⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        153⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        150⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        151⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        151⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        152⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        149⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        150⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        150⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        151⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        148⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        149⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        149⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        150⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        147⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        148⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        148⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        149⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        146⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        147⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        147⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        148⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        145⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        146⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        146⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        147⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        144⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        145⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        145⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        146⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        143⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        144⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        144⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        145⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        142⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        143⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        143⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        144⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        141⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        142⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        142⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        143⤵
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        140⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        141⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        141⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        142⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        139⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        140⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        140⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        141⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        138⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        139⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        139⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        140⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        137⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        138⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        138⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        139⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        136⤵
        
        PID:308
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        137⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        137⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        138⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        135⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        136⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        136⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        137⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        134⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        135⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        135⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        136⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        133⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        134⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        134⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        135⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        132⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        133⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        133⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        134⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        131⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        132⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        132⤵
        
        PID:508
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        133⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        130⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        131⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        131⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        132⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        129⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        130⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        130⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        131⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        128⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        129⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        129⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        130⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        127⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        128⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        128⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        129⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        126⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        127⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        127⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        128⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        125⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        126⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        126⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        127⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        124⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        125⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        125⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        126⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        123⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        124⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        124⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        125⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        122⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        123⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        123⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        124⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        121⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        122⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        122⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        123⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        120⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        121⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        121⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        122⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        119⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        120⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        120⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        121⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        118⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        119⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        119⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        120⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        117⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        118⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        118⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        119⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        116⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        117⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        117⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        118⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        115⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        116⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        116⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        117⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        114⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        115⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        115⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        116⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        113⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        114⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        114⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        115⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        112⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        113⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        113⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        114⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        111⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        112⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        112⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        113⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        110⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        111⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        111⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        112⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        109⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        110⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        110⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        111⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        108⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        109⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        109⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        110⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        107⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        108⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        108⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        109⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        106⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        107⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        107⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        108⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        105⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        106⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        106⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        107⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        104⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        105⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        105⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        106⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        103⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        104⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        104⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        105⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        102⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        103⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        103⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        104⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        101⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        102⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        102⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        103⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        100⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        101⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        101⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        102⤵
        
        PID:812
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        99⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        100⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        100⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        101⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        98⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        99⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        99⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        100⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        97⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        98⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        98⤵
        
        PID:828
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        99⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        96⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        97⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        97⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        98⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        95⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        96⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        96⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        97⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        94⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        95⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        95⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        96⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        97⤵
        
        PID:7644
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        98⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        93⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        94⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        94⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        95⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        96⤵
        
        PID:5176
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        97⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        92⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        93⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        93⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        94⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        95⤵
        
        PID:1740
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        96⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        91⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        92⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        92⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        93⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        94⤵
        
        PID:7224
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        95⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        90⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        91⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        91⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        92⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        93⤵
        
        PID:7408
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        94⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        89⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        90⤵
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        90⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        91⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        92⤵
        
        PID:7848
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        93⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        88⤵
        
        PID:504
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        89⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        89⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        90⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        91⤵
        
        PID:8108
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        92⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        87⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        88⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        88⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        89⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        90⤵
        
        PID:8324
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        91⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        86⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        87⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        87⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        88⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        89⤵
        
        PID:8092
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        90⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        85⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        86⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        86⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        87⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        88⤵
        
        PID:8172
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        89⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        84⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        85⤵
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        85⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        86⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        87⤵
        
        PID:824
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        88⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        83⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        84⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        84⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        85⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        86⤵
        
        PID:8528
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        87⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        82⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        83⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        83⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        84⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        85⤵
        
        PID:8852
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        86⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        81⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        82⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        82⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        83⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        84⤵
        
        PID:9136
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        85⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        80⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        81⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        81⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        82⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        83⤵
        
        PID:7452
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        84⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        79⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        80⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        80⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        81⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        82⤵
        
        PID:1348
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        83⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        78⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        79⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        79⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        80⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        81⤵
        
        PID:5936
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        82⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        77⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        78⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        78⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        79⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        80⤵
        
        PID:6688
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        81⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        76⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        77⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        77⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        78⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        79⤵
        
        PID:2280
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        80⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        75⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        76⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        76⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        77⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        78⤵
        
        PID:7092
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        79⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        74⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        75⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        75⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        76⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        77⤵
        
        PID:5720
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        78⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        73⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        74⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        74⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        75⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        76⤵
        
        PID:8608
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        77⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        72⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        73⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        73⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        74⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        75⤵
        
        PID:8676
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        76⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        71⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        72⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        72⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        73⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        74⤵
        
        PID:8428
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        75⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        70⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        71⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        71⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        72⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        73⤵
        
        PID:8560
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        74⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        69⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        70⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        70⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        71⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        72⤵
        
        PID:8776
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        73⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        68⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        69⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        69⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        70⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        71⤵
        
        PID:5540
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        72⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        67⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        68⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        68⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        69⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        70⤵
        
        PID:208
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        71⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        66⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        67⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        67⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        68⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        69⤵
        
        PID:6940
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        70⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        65⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        66⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        66⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        67⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        68⤵
        
        PID:6248
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        69⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        64⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        65⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        65⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        66⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        67⤵
        
        PID:6608
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        68⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        63⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        64⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        64⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        65⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        66⤵
        
        PID:6648
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        67⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        62⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        63⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        63⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        64⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        65⤵
        
        PID:8616
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        66⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        61⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        62⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        62⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        63⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        64⤵
        
        PID:4104
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        65⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        60⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        61⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        61⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        62⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        63⤵
        
        PID:3860
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        64⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        59⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        60⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        60⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        61⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        62⤵
        
        PID:6776
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        63⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        58⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        59⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        59⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        60⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        61⤵
        
        PID:7228
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        62⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        57⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        58⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        58⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        59⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        60⤵
        
        PID:8820
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        61⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        56⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        57⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        57⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        58⤵
        
        PID:756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        59⤵
        
        PID:8900
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        60⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        55⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        56⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        56⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        57⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        58⤵
        
        PID:8672
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        59⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        54⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        55⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        55⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        56⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        57⤵
        
        PID:9044
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        58⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        53⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        54⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        54⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        55⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        56⤵
        
        PID:7672
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        57⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        52⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        53⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        53⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        54⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        55⤵
        
        PID:6124
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        56⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        51⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        52⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        52⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        53⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        54⤵
        
        PID:6844
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        55⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        50⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        51⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        51⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        52⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        53⤵
        
        PID:7716
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        54⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        49⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        50⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        50⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        51⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        52⤵
        
        PID:920
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        53⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        48⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        49⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        49⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        50⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        51⤵
        
        PID:7784
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        52⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        47⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        48⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        48⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        49⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        50⤵
        
        PID:2728
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        51⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        46⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        47⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        47⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        48⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        49⤵
        
        PID:7048
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        50⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        45⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        46⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        46⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        47⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        48⤵
        
        PID:7556
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        49⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        44⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        45⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        45⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        46⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        47⤵
        
        PID:7780
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        48⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        43⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        44⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        44⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        45⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        46⤵
        
        PID:9092
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        47⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        42⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        43⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        43⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        44⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        45⤵
        
        PID:8912
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        46⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        41⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        42⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        42⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        43⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        44⤵
        
        PID:5764
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        45⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        40⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        41⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        41⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        42⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        43⤵
        
        PID:5968
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        44⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        39⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        40⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        40⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        41⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        42⤵
        
        PID:8424
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        43⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        38⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        39⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        39⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        40⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        41⤵
        
        PID:6660
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        42⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        37⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        38⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        38⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        39⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        40⤵
        
        PID:4452
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        41⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        36⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        37⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        37⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        38⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        39⤵
        
        PID:2884
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        40⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        35⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        36⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        36⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        37⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        38⤵
        
        PID:4684
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        39⤵
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        34⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        35⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        35⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        36⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        37⤵
        
        PID:9012
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        38⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        33⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        34⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        34⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        35⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        36⤵
        
        PID:9100
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        37⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        32⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        33⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        33⤵
        
        PID:648
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        34⤵
        
        PID:704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        35⤵
        
        PID:9004
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        36⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        31⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        32⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        32⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        33⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        34⤵
        
        PID:8944
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        35⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        30⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        31⤵
        
        PID:364
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        31⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        32⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        33⤵
        
        PID:8824
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        34⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        29⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        30⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        30⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        31⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        32⤵
        
        PID:8588
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        33⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        28⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        29⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        29⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        30⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        31⤵
        
        PID:8428
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        32⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        27⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        28⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        28⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        29⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        30⤵
        
        PID:3004
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        31⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        26⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        27⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        27⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        28⤵
        
        PID:68
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        29⤵
        
        PID:2816
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        30⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        25⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        26⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        26⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        27⤵
        
        PID:760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        28⤵
        
        PID:1932
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        29⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        24⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        25⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        25⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        26⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        27⤵
        
        PID:7008
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        28⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        23⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        24⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        24⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        25⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        26⤵
        
        PID:5540
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        27⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        22⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        23⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        23⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        24⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        25⤵
        
        PID:6028
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        26⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        21⤵
        
        PID:68
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        22⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        22⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        23⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        24⤵
        
        PID:3640
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        25⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        20⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        21⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        21⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        22⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        23⤵
        
        PID:6320
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        24⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        19⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        20⤵
        
        PID:592
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        20⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        21⤵
        
        PID:664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        22⤵
        
        PID:6936
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        23⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        18⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        19⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        19⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        20⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        21⤵
        
        PID:7804
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        22⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        17⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        18⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        18⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        19⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        20⤵
        
        PID:2864
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        21⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        16⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        17⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        17⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        18⤵
        
        PID:220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        19⤵
        
        PID:4148
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        20⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        15⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        16⤵
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        16⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        17⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        18⤵
        
        PID:4248
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        19⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        14⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        15⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        15⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        16⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        17⤵
        
        PID:6180
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        18⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        13⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        14⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        14⤵
        
        PID:708
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        15⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        16⤵
        
        PID:7696
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        17⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        12⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        13⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        13⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        14⤵
        
        PID:928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        15⤵
        
        PID:428
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        16⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        11⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        12⤵
        
        PID:656
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        12⤵
        
        PID:220
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        13⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        14⤵
        
        PID:7864
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        15⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        10⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        11⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        11⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        12⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        13⤵
        
        PID:7632
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        14⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        9⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        10⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        10⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        11⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        12⤵
        
        PID:6868
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        13⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        8⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        9⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        9⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        10⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        11⤵
        
        PID:8
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        12⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        7⤵
        Executes dropped EXE
        
        PID:368
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        8⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        8⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        9⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        10⤵
        
        PID:5200
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        11⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        6⤵
        Executes dropped EXE
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        7⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        7⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        8⤵
        
        PID:976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        9⤵
        
        PID:6704
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        10⤵
        
        PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        6⤵
        Executes dropped EXE
        
        PID:504
      - C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4204
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        7⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        8⤵
        
        PID:1956
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        9⤵
        
        PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
      "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        5⤵
        Executes dropped EXE
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        5⤵
        Executes dropped EXE
        
        PID:1376
- - C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
    "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:196
  - - C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
      "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
      4⤵
      Executes dropped EXE
      PID:1352
  - - C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
      "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2612
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
        5⤵
        
        PID:3592
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        6⤵
        
        PID:7060
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        7⤵
        
        PID:5924
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vfbbjmzp\vfbbjmzp.cmdline"
        8⤵
        
        PID:4248
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBC6A.tmp" "c:\Windows\System32\CSC9FF4129AE80E497B8E49B88BE619572C.TMP"
        9⤵
        
        PID:7492
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\X3TY75Wnwh.bat"
        8⤵
        
        PID:7392
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:8108
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:4140
        
        C:\Webnet\portmonitor.exe
        
        "C:\Webnet\portmonitor.exe"
        9⤵
        
        PID:5256
- C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
  "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
    "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
    3⤵
    - Executes dropped EXE
    PID:4580
- - C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
    "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2288
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
      4⤵
      PID:4804
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
        5⤵
        
        PID:6920
      - C:\Webnet\portmonitor.exe
        
        "C:\Webnet/portmonitor.exe"
        6⤵
        
        PID:5540

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4804
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\System.exe'" /f
  2⤵
  - Process spawned unexpected child process
  - Creates scheduled task(s)
  PID:4248
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Creates scheduled task(s)
  PID:6868
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Creates scheduled task(s)
  PID:4336
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "3b73a6fa2092a350d7953" /sc MINUTE /mo 14 /tr "'C:\Webnet\3b73a6fa2092a350d795.exe'" /f
  2⤵
  - Process spawned unexpected child process
  - Creates scheduled task(s)
  PID:7680
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "3b73a6fa2092a350d795" /sc ONLOGON /tr "'C:\Webnet\3b73a6fa2092a350d795.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Creates scheduled task(s)
  PID:7828
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "3b73a6fa2092a350d7953" /sc MINUTE /mo 14 /tr "'C:\Webnet\3b73a6fa2092a350d795.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Creates scheduled task(s)
  PID:8004
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "3b73a6fa2092a350d7953" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\3b73a6fa2092a350d795.exe'" /f
  2⤵
  - Process spawned unexpected child process
  - Creates scheduled task(s)
  PID:4384
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "3b73a6fa2092a350d795" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\3b73a6fa2092a350d795.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Creates scheduled task(s)
  PID:7192
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "3b73a6fa2092a350d7953" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\3b73a6fa2092a350d795.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Creates scheduled task(s)
  PID:6272
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\cmd.exe'" /f
  2⤵
  - Process spawned unexpected child process
  - Creates scheduled task(s)
  PID:7260
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\cmd.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Creates scheduled task(s)
  PID:2612
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\cmd.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Creates scheduled task(s)
  PID:7792
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\wscript.exe'" /f
  2⤵
  - Process spawned unexpected child process
  - Creates scheduled task(s)
  PID:7900
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\wscript.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Creates scheduled task(s)
  PID:7960
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\wscript.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Creates scheduled task(s)
  PID:7740
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "portmonitorp" /sc MINUTE /mo 6 /tr "'C:\Webnet\portmonitor.exe'" /f
  2⤵
  - Process spawned unexpected child process
  - Creates scheduled task(s)
  PID:8080
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "portmonitor" /sc ONLOGON /tr "'C:\Webnet\portmonitor.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Creates scheduled task(s)
  PID:2736
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn "portmonitorp" /sc MINUTE /mo 9 /tr "'C:\Webnet\portmonitor.exe'" /rl HIGHEST /f
  2⤵
  - Process spawned unexpected child process
  - Creates scheduled task(s)
  PID:7584

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Sidebar\wscript.exe

Filesize
3.5MB

MD5
aa6c98cd853bf585a410394fd10817dc

SHA1
ceab1865997ae2c6e070a9c6adf6b129cf2ad383

SHA256
fc45eebea5ae88160a2ac49fe7e027baeee028c4f4b021794726a04ecea8c90b

SHA512
2ada05425dce38fd9fe48c9ceb6a21c59c5e7088274c4445dfde054974f14f8feba5012909c5a75d7932a6bcbb488e38d34d9c970cd61c636ee13abc59e06562

Download Submit
C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe

Filesize
5.2MB

MD5
b86bbb42b26e72a601087f68cda89208

SHA1
baca49e35da3b83cd56ba579d61f98e9b137debe

SHA256
320eff01b2a5b520853cd9b0c7486b3d9992dce2f9308f267069a60f88f8deb0

SHA512
e98dfeb55d6053d6e2ec323f4665b4ea8cdb5bae0807ac70ac5dbb6cf7f3e8e1ba6a2ad099f8232b0e0ca9a738a9baf7d132957fb5d503c78283b229e35ed974

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe

Filesize
8.7MB

MD5
57ec49d438753f3bdfec6a616258b370

SHA1
a34f757f5f2bd4763f04206c0d0cd32ab4491117

SHA256
872a2f4decf76a5c8cf44a9b017a780847d8b3c50571433232e398ab0931c638

SHA512
88bdae1b6a45efa83c4a9ff28a4549c33db28ba2bb1d1911d028090e9dc3831ef57f6577388844a4cfccc60dbca70315a7f9d7311f6638bcf00da97110e1c64a

Download Submit
C:\Users\Admin\AppData\Local\Temp\leetcrack.exe

Filesize
8.7MB

MD5
93144ffd83e528ff8651605be2d2c1a4

SHA1
6c661ce690ecd3ecd21c8953e410543fcf8a69ad

SHA256
4ded33a5b292e88739e50c25c4db2ec8a4b444b21431f3daba87a2573965bd60

SHA512
5236edcac0e56126c0f83eccc930a96548788694e1505ee0f74e77ed41582b1c92573de2fef0bf1e69fa3e9bc355f45f4671a67da66612e1a24b8eb849ea668c

Download Submit
C:\Users\Admin\AppData\Local\Temp\portmonitor.exe

Filesize
3.8MB

MD5
3d686dda8f890bef092779bc682dec10

SHA1
2e6f12de7a5d4febe798a63b2f8914458741bf7f

SHA256
af9b7828f0661720eeaac5931f160f7db17dbf6c1ddcd7020a0c06a4deb2b7d4

SHA512
cb32222a74d01de5c99e5096e1e00f86ab54af0db9e6b560b5952de2ab1c654ebde7331e80302dedb387acc7ad7c98eae3748cf3bf2bb78c1d0a5088db881f58

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
7b461cf8382e33bedec60fe422c8a9df

SHA1
7fd729947c7b185e92035a7e1fde6580ae1ec799

SHA256
37f71d29742c1b1c7af3598c891438e242c507644f27145ef70506d14a380c16

SHA512
40c92c98cc4986324dd1a78fe14c76b84fc1f34ec8d8889fd4b5e9b667c41075dc0e56d2578dbe6be2c75108e650337a2173899e76138fbff2adc3d664440021

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\4ded82f5-3a37-4a37-b28f-f36917d6c5d9

Filesize
10KB

MD5
3732ee1b72050e1a14b1b4d7d4856b77

SHA1
08b668c31fb34e9c14766a71423d37983d9cf34e

SHA256
6b6f3061a798b916ebaa840477eda021b1c7f21af5aea086f775fb1224d979c2

SHA512
2a83ef346d9b2f2d09cbff950091e87360c5013b5c7fb9c2181911df20f8e682d93546f63317f96bba48b861de165c52410d502797c473415e1984b0122ab638

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\de19e503-0e5a-4c09-97cc-0c6562134de8

Filesize
746B

MD5
41fd51713760b58c3b170cec81cdc2d5

SHA1
3b22ce80428406576c55d0d02d67e8111c57cc71

SHA256
852083ced012ea555ac5bccfaca4d59eabb07548352cfc7b7c08b8c8259881b0

SHA512
8ba272f83cc3b274e2c0b658e354894b3b47380b21e4e2a65f08ad3a77d2658f2216aee47f61e183b08c5cb5a807203fd97c05fc24d3d4743d3511d79ec2a9b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js

Filesize
6KB

MD5
657f175d1166e7adaa002fed9b3608f5

SHA1
40d629cb469405c2939fdd6dc5f72f99898a8f0b

SHA256
7f59455e3bc37e0f874037663806bf6dec51855814ef2108c20e406d8c7bcbf5

SHA512
c27e9b113618fd085256e2ae27e0f91222fcaaf0e06fde1c13eb574db9f23bb9014463da03c759820caa0b8e46d7d22f2425f7089bcc74c47e8fa7be6eaa56cf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs.js

Filesize
6KB

MD5
6e939c7f9fc82c6c20d2b0a8e8338e66

SHA1
08037d668f7812459da8371d3bf6c1ab358036c0

SHA256
16b34e1e6b0e136cdf68a19d35a11f156d1422189765e49c31c2901dc036367d

SHA512
19960cca856e205ec62868bd03a667219221dd2a9e9b3b23544e6e386c9057f578a1698c3c6da8dab338b4e4b125a1c3564dff8241ea72bf2ab047320ac47991

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs.js

Filesize
6KB

MD5
a142313060c6ca044f683489ff7e62c6

SHA1
621c8446d9b40ad6369b0667e71c3cf3a1a2ad61

SHA256
07022bcf86c65c1ef29becd4d63c10a644eadb45dcb7e38f1b495f1cadd627d1

SHA512
36caf007f50afcf53813c5bb801242be1c0e459e118a7dd7d90f2acf133508485dc9ea932aa26b0695d569a0808d183ed64aa10840172601df7b75aa9b6e10eb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
336a8a135872204dfad93c8da8e9b50a

SHA1
0016667916df06cafbbd98e9999a990047d77ba7

SHA256
e19f1f650f5a7e0d504450ea8c0298a414882e93500772beab24c99fd3a17bf7

SHA512
913fd35fa5fe956bcbdba2fe21235d2c95c67fafff2ee6fe91b09fe0d3797a6fab81234f8b2e3b8e728231c575e2ea8682b80ff53ba4297b69d095ec8aa4244e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
410eab80ff1548b91dfb4f634b2c9535

SHA1
4f9f00febad9e2e481426de7611c07f1f51d8012

SHA256
7416e7891224d58c8be22ec0e1b0ff9da3e4de4ae2eb0d4662d15de9a82e74b1

SHA512
d4277a76494d2e8b34fd41fd655586f2e51389bde45dfe53153e172e9808206801e932f9d22c879c7bad199f1c1db016405407cdc3f9aca94c41422d78fe6118

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
681158dcbf9da75425b901acc0c78eb5

SHA1
4ce212be326e5cebc79c677dba8e5a83e80c889b

SHA256
06d83254d8528936ce89079f96dfe769516192b14baed03a1ac4b688fe17739a

SHA512
b4aa14fc3d658221547d0e5576d6200f604d4c115625270946c02771b3605ca02cc9b19ff5ca1955ea959b9e564f1ff96d57020772ecb48f1f9090186427a7ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
b80aa08f4cd02898b2f1781ce3937e47

SHA1
abd52bf28f05f8e13f534051c1342a93f5914da5

SHA256
f07dfb15cc0e10a7f34bd733850358fc2f8cc5e81109f20e3d5b4aebde82c251

SHA512
68b5fdc13724b02bc8e8457b7469c2ff4e33e337fdab40b10572e0f80c4ba75b684a459bbe08455250014235d48cbad40c2b8d80735b7d6b83d59bee93466cce

Download Submit
C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe

Filesize
209B

MD5
1fefc5b72cd89c9f83dcf8a47b254f58

SHA1
909c965e493baab2203bac16be714cfb88a75f0d

SHA256
7f03a5563b7186e6c6efa09392c843783b9a3375bcfbe29e4b9c8fc6f3032c3c

SHA512
5bada5c497c306276c348569995cb254b3e6dcf2a8c10e48eadded26b69e7d5690503b8d9610f46b91a28effbe4be8d7345938d8c59d9f5343186f4d60e526ca

Download Submit
memory/4580-27-0x00007FF7CB880000-0x00007FF7CC4AA000-memory.dmp

Filesize
12.2MB

Download
memory/4832-135-0x0000000000CD0000-0x0000000000D7E000-memory.dmp

Filesize
696KB

Download
memory/4832-136-0x0000000000CD0000-0x0000000000E1A000-memory.dmp

Filesize
1.3MB

Download
memory/5924-259-0x000000001C280000-0x000000001C2DA000-memory.dmp

Filesize
360KB

Download
memory/5924-226-0x000000001C170000-0x000000001C1C0000-memory.dmp

Filesize
320KB

Download
memory/5924-257-0x000000001C160000-0x000000001C170000-memory.dmp

Filesize
64KB

Download
memory/5924-253-0x000000001C150000-0x000000001C160000-memory.dmp

Filesize
64KB

Download
memory/5924-263-0x000000001C230000-0x000000001C240000-memory.dmp

Filesize
64KB

Download
memory/5924-269-0x000000001C250000-0x000000001C25C000-memory.dmp

Filesize
48KB

Download
memory/5924-267-0x000000001C2E0000-0x000000001C2F8000-memory.dmp

Filesize
96KB

Download
memory/5924-271-0x000000001C350000-0x000000001C39E000-memory.dmp

Filesize
312KB

Download
memory/5924-265-0x000000001C240000-0x000000001C24E000-memory.dmp

Filesize
56KB

Download
memory/5924-251-0x000000001C140000-0x000000001C14E000-memory.dmp

Filesize
56KB

Download
memory/5924-261-0x000000001C220000-0x000000001C22E000-memory.dmp

Filesize
56KB

Download
memory/5924-234-0x000000001BCC0000-0x000000001BCD0000-memory.dmp

Filesize
64KB

Download
memory/5924-230-0x000000001C120000-0x000000001C138000-memory.dmp

Filesize
96KB

Download
memory/5924-249-0x000000001C750000-0x000000001CC76000-memory.dmp

Filesize
5.1MB

Download
memory/5924-225-0x000000001BCE0000-0x000000001BCFC000-memory.dmp

Filesize
112KB

Download
memory/5924-246-0x000000001C200000-0x000000001C212000-memory.dmp

Filesize
72KB

Download
memory/5924-244-0x000000001C1E0000-0x000000001C1F6000-memory.dmp

Filesize
88KB

Download
memory/5924-236-0x000000001BCD0000-0x000000001BCDE000-memory.dmp

Filesize
56KB

Download
memory/5924-242-0x000000001BD00000-0x000000001BD10000-memory.dmp

Filesize
64KB

Download
memory/5924-240-0x000000001C1C0000-0x000000001C1D2000-memory.dmp

Filesize
72KB

Download
memory/5924-232-0x0000000003180000-0x0000000003190000-memory.dmp

Filesize
64KB

Download
memory/5924-228-0x00000000030E0000-0x00000000030F0000-memory.dmp

Filesize
64KB

Download
memory/5924-223-0x00000000030D0000-0x00000000030DE000-memory.dmp

Filesize
56KB

Download
memory/5924-219-0x0000000003140000-0x0000000003166000-memory.dmp

Filesize
152KB

Download
memory/5924-213-0x0000000000CE0000-0x000000000106E000-memory.dmp

Filesize
3.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads